gate-and-ship или gh-guard

Quality gates then ship — chains `/prepare-delivery` and `/ship` in one command. Runs the full pre-ship pipeline (deslop, simplify, agnix, enhance, multi-agent review, delivery validation, docs sync) and only proceeds to commit/push/PR/merge/deploy if every gate passes. If a gate fails, returns to the implementation phase with concrete fix instructions instead of shipping broken code. Designed for the "I'm done; ship it" workflow where you don't want to think about which gates to run — they all run, in the right order, with the right pass criteria.

GH-Guard hardens CI/CD pipelines for Rust projects. It generates production-tested GitHub Actions workflows with SHA-pinned actions, OIDC-based Trusted Publishing, SLSA L3 provenance, and layered dependency auditing via cargo-deny, Dependabot, and osv-scanner. Five commands: /audit scans your repo against supply chain best practices, /harden walks you through fixes at three levels (Minimal/Standard/Hardened), /generate creates individual config files, /check-updates catches stale SHA pins, and /verify validates everything before you push. 14 skills provide deep context on Scorecard checks, dangerous workflow patterns, release automation, workspace publishing, fuzz testing, and compromised action incident response. All guidance is informed by real-world incidents including the March 2026 Trivy tag hijacking.