ship

An agent skill by garrytan, from garrytan/gstack. Tags: delivery, deployment, release-management, workflow.

What it does

Ship workflow: detect + merge base branch, run tests, review diff, bump VERSION, update CHANGELOG, commit, push, create PR. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill ship

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/ship ~/.claude/skills/ship

Safety box score

Grade F, high risk: 91 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is an end-to-end shipping skill: it merges the base branch, runs tests and reviews, bumps version and changelog, commits, pushes, opens PRs, and can also drive App Store/TestFlight release flows. The main risks are broad external side effects, credential and dotfile access, and prompt instructions that reduce normal confirmation checks; parts of the workflow could not be fully inspected because three referenced sections were unreadable.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It shells out broadly to `git fetch/merge/push`, `bun run`, `fastlane`, `npm install -g`, and Codex helpers, so it can execute many installed commands.
Network access	3 (high)	It contacts external services by design (`git fetch`, `git push`, `gh`/`glab`, WebSearch, Codex outside review, App Store Connect), so the network blast radius is large.
Filesystem reach	3 (high)	It writes outside the repo into home and tool state (`~/.claude/`, `~/.gstack/`, `~/.fastlane/`, `~/.appstoreconnect/`) and uses recursive temp cleanup (`rm -rf ...`).
Secrets & credentials	3 (high)	The Apple path explicitly handles sessions and keys (`fastlane spaceauth`, `~/.fastlane/spaceship/`, `~/.gstack/apple/api-key.json`), and the review flow references `CODEX_API_KEY` and `UBICLOUD_API_KEY`.
Privilege & persistence	2 (moderate)	It installs or registers tooling and hooks (`brew install fastlane`, `npm install -g @openai/codex`, `install-prepush-hook`, git hook/config changes), which is a real machine-level change but not sudo-level.
Instruction hijack surface	3 (high)	It tells the agent to treat the skill as executable instructions, auto-choose recommendations in spawned/unattended modes, and includes lines like `Run it without confirmation`, which pushes past normal confirmation boundaries.
Irreversible actions	3 (high)	Its purpose is to merge, commit, push, create PRs, and optionally submit releases, so it can make irreversible external changes without a separate human action at each step.
Transparency	2 (moderate)	Three referenced sections were not readable in this review (`sections/tests.md`, `sections/test-coverage.md`, `sections/review-army.md`), so parts of the release/test/review flow could not be fully inspected.

Before installing

Read `SKILL.md` and `sections/apple-release.md` if you might use the Apple release path; it can mint and store release credentials.
Confirm you are okay with an agent that can merge `origin/<base>`, commit, push, and open PRs with little extra prompting.
Check whether writes under `~/.claude/`, `~/.gstack/`, `~/.fastlane/`, and `~/.appstoreconnect/` are acceptable on this machine.

Rated 2026-10-16 by an automated review of 13 files from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: ship/SKILL.md
Branch: main
Updated: 2026-10-05

land-and-deploy — Land and deploy workflow. (gstack)
eas-app-stores — EAS service (paid). Build and submit iOS and Android apps with EAS to TestFlight, the App Store, or Google Play.
eas-update — EAS service (paid). Configure and use EAS Update for over-the-air JavaScript and asset updates with expo-updates and EAS CLI.
eas-update-insights — EAS service (paid). Check the health of published EAS Update: crash rates, install/launch counts, unique users, payload size.
eas-workflows — EAS service (paid). Helps understand and write EAS workflow YAML files for Expo projects.
expo-dev-client — Framework (OSS). Build and distribute Expo development clients locally or via TestFlight for internal testing.