deploying-to-production — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited deploying-to-production (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Savecraft has independently versioned components. Each has its own tag prefix, deploy workflow, and relevant paths. Production deploys are triggered by pushing a semver tag.
Always start by running the script. Do not attempt to find tags or diff history manually.
bash .claude/skills/deploying-to-production/scripts/propose-releases.shThe script handles tag discovery, path filtering, and net-diff calculation. It only shows components with actual changes (not commits that touched-then-reverted a path).
For each component with changes, review the commits and diff stat. Present a summary table:
| Component | Current Tag | Proposed Tag | Reason |
|---|---|---|---|
| cloud | cloud-v1.X.Y | cloud-v1.X+1.0 | ... |
After the user approves, provide the exact git commands:
git tag <tag> && git push origin <tag>Each tag push triggers its deploy workflow automatically via GitHub Actions.
| Component | Tag Prefix | Workflow | What Deploys |
|---|---|---|---|
| Daemon | daemon-v | deploy-daemon.yml | Go binaries (Linux/macOS/Windows), MSI, R2 upload, GitHub Release |
| Cloud | cloud-v | deploy-cloud.yml | Worker (API/MCP/DOs) + Web (Pages) + Site (Pages) + D1 migrations |
| Install | install-v | deploy-install.yml | Install Worker + curl script to R2 |
| Plugin | plugin-{game}-v | deploy-plugin.yml | WASM parser + manifest + icon to R2 |
Reference modules have split deploy targets depending on their type:
| Module type | Identified by | Cloud deploys | Plugin deploys |
|---|---|---|---|
| Native TS (e.g. MTGA) | reference/register.ts exists | Entire reference/ dir (bundled into worker) | Nothing from reference/ |
| WASM Go (e.g. Factorio, RimWorld) | No register.ts | Only reference/views/ (Svelte → views.gen.ts) | reference/*.go, reference/data/ (compiled to .wasm) |
The script handles this automatically. When both cloud and plugin show changes for the same game, both need releases — the view HTML and the WASM binary are separate artifacts.
Committed codegen — plugins/magic/parser/data/arena_cards_gen.go and the plugins/{d2r,factorio,rimworld,stellaris}/reference/data/*_gen.{go,rs} files — is version-pinned code, not cadence data. It is regenerated through a reviewed, CI-gated Pull Request, never by the nightly data refresh and never by a direct push to main.
just datagen-<game> (v1: just datagen-magic). It runsthe game's datagen on the host where the game data lives, and only if the artifact changed opens/updates a PR on datagen/<game>-... using the host's existing gh auth (no bot account). A no-diff run is a no-op.
just update-mtga populates D1 cadence data only and mustnever mutate a tracked file. (Cadence data — Scryfall/17lands/rules — lives in D1 and is out of git entirely.)
plugin-{game}-v release that should carry newgame-data coverage** (e.g. a new MTGA set), run just datagen-<game>, merge the resulting PR, then cut the tag. The merged codegen is what the WASM/parser build embeds.
just datagen-<game> shape as theirdatagen is automated; the rule above is the same for each.
git tag --sort=-version:refnamegit diff --stat <tag>..HEAD -- <paths> to check for net changesplugin-*-v* tagsinternal/ cmd/ go.mod go.sumworker/ web/ site/ + native TS reference/ dirs + WASM reference/views/ dirsinstall/plugins/{game}/ excluding tools/, excluding reference/views/ (WASM) or reference/ (native TS)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.