Skip to content
Back to skills

Repository Delivery Gate

ASecurity

Decide whether a repository change is ready for review, merge, release, deployment, or handoff using evidence proportionate to risk.

  • 2 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added October 15, 2026
securityrustsecuritydocumentation

Security analysis

A100/100

Scanned October 15, 2026

npx -y skills add sodejm/copilot-operation-plugin-for-security --skill repository-delivery-gate --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Repository Delivery Gate?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Repository Delivery Gate
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/sodejm-repository-delivery-gate/badge)](https://www.skillsdirectory.com/skills/sodejm-repository-delivery-gate)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: repository-delivery-gate
description: Decide whether a repository change is ready for review, merge, release, deployment, or handoff using evidence proportionate to risk.
---

# Repository delivery gate

Evaluate the requested transition, not an assumed one.

- Scope: acceptance criteria are met and unrelated work is excluded.
- Artifact: exact diff, branch, commit, generated files, and migrations are known.
- Quality: focused checks and `make check` pass in the current checkout.
- Documentation: user, contributor, architecture, operations, and security impact
  is updated or a no-impact rationale is recorded.
- Security: secrets, dependencies, permissions, untrusted input, and abuse cases
  receive review proportionate to risk.
- Operations: rollout, compatibility, data migration, observability, and rollback
  are addressed when applicable.
- Hosted state: PR reviews, required checks, mergeability, release, and deployment
  are refreshed from authoritative sources when relevant.

Return one outcome: ready, ready with stated residual risk, or not ready with a
specific blocker. Keep local commit, pushed branch, open PR, merged PR, release,
and deployment states distinct. Do not perform the transition unless authorized.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.