land-and-deploy

An agent skill by garrytan, from garrytan/gstack. Tags: deployment, release-management, workflow.

What it does

Land and deploy workflow. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill land-and-deploy

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/land-and-deploy ~/.claude/skills/land-and-deploy

Safety box score

Grade F, high risk: 68 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a release workflow: it checks CI and reviews, merges a PR, watches deployment, and can verify or roll back production. The main risks are high blast radius from merge/deploy/rollback actions, plus reliance on local helper commands and authenticated network access.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It is driven by shell commands and helper executables, including `gh pr merge`, `git revert`, `curl`, `gh run view`, and local binaries like `~/.claude/skills/gstack/bin/gstack-ci-gate`.
Network access	2 (moderate)	It contacts GitHub/GitLab APIs, deploy platforms, and production URLs, for example `gh auth status`, `gh run list`, and `curl -sf {production-url}`.
Filesystem reach	2 (moderate)	It reads and writes outside the project in `~/.claude/skills/gstack`, `~/.gstack`, and `.gstack/deploy-reports`, including the `land-deploy-confirmed` fingerprint and report files.
Secrets & credentials	2 (moderate)	It relies on authenticated CLI and browser sessions and explicitly mentions cookie import: `Headless, no user cookies. An authenticated page needs /setup-browser-cookies (imports real-browser cookies)`.
Privilege & persistence	1 (low)	It does not ask for sudo or service installation, but it does operate with privileged account access through GitHub CLI and signed-in browser sessions.
Instruction hijack surface	2 (moderate)	It will follow one-time instruction blocks from command output: `GSTACK_INSTRUCTION_BEGIN ... Follow each before continuing`, and it auto-chooses options in `spawned`/`unattended` sessions.
Irreversible actions	3 (high)	Its purpose is to merge, delete branches, deploy, and potentially revert production, e.g. `gh pr merge ... --delete-branch` and `git push ... HEAD:refs/heads/$BASE_BRANCH`.
Transparency	2 (moderate)	Core behavior depends on external local helper scripts that are not included in the reviewed files, such as `gstack-skill-start`, `gstack-ci-gate`, `gstack-review-read`, and `gstack-skill-end`.

Before installing

Read `sections/merge-and-deploy.md` and `sections/readiness-gate.md`; those are the irreversible parts.
Inspect `~/.claude/skills/gstack/bin/gstack-skill-start` and `gstack-ci-gate` locally before trusting the workflow.
Run `gh auth status` in a scratch repo first and confirm the PR/base branch are the ones you expect.
Try it once on a throwaway or non-production PR before letting it touch a real release.

Rated 2026-10-21 by an automated review of 5 files from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: land-and-deploy/SKILL.md
Branch: main
Updated: 2026-10-05

ship — Ship workflow: detect + merge base branch, run tests, review diff, bump VERSION, update CHANGELOG, commit, push, create PR. (gstack)
eas-app-stores — EAS service (paid). Build and submit iOS and Android apps with EAS to TestFlight, the App Store, or Google Play.
eas-update — EAS service (paid). Configure and use EAS Update for over-the-air JavaScript and asset updates with expo-updates and EAS CLI.
eas-update-insights — EAS service (paid). Check the health of published EAS Update: crash rates, install/launch counts, unique users, payload size.
eas-workflows — EAS service (paid). Helps understand and write EAS workflow YAML files for Expo projects.
expo-dev-client — Framework (OSS). Build and distribute Expo development clients locally or via TestFlight for internal testing.