aksheyw

Claude Code Ship Gate — Security skill for Claude Code

Security community

Pre-push quality gate for Claude Code that runs above git, so git push --no-verify can't skip it.

How to install Claude Code Ship Gate

This entry records only its repository, not the path inside it, so there is no exact command to give. Open aksheyw/claude-code-ship-gate and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Claude Code Ship Gate does

Pre-push quality gate for Claude Code that runs above git, so git push --no-verify can't skip it. Tests, code review, security, and a secret scan must pass before any push to your protected branch. Say 'ship it' to run it.

Alternatives in Security

Tier 3 Code Refinement Report — Date: 2026-03-20 Status: ALL 54 FINDINGS IMPLEMENTED Scope: Full codebase (18 plugins, 888 files, ~266K lines) 222 ★
Review Branch — Review an existing branch holistically before merging — blast radius, conventions, security, and spec complian 55 ★
Craft Review — PR review skill - invokes pr-reviewer-expert agent against branch diff, story commits, or full project audit 52 ★

README

🚦 Ship Gate: a pre-push quality gate for Claude Code that an agent can't skip with a flag

I kept skipping my own checks at 1am. This one doesn't let me.

![requires Claude Code](https://img.shields.io/badge/requires-Claude%20Code-D97757) ![runs above git](https://img.shields.io/badge/runs-above%20git-0E9384) ![built with bash, jq and awk](https://img.shields.io/badge/built%20with-bash%20%2B%20jq%20%2B%20awk-1B2A4A) ![release](https://img.shields.io/github/v/release/aksheyw/claude-code-ship-gate) ![license MIT](https://img.shields.io/badge/license-MIT-green) ![CI](https://github.com/aksheyw/claude-code-ship-gate/actions/workflows/ci.yml/badge.svg)

Claude Code is Anthropic's AI coding assistant: it runs in your terminal, reads your project's files, and can change them for you. Ship Gate is a plugin for it, a bundle you install and switch on in one go. Before Claude can push to your main branch, it has to get past whichever of the eight checks apply to what you changed, from tests and type checks through to a secret scan and a code review. Fail one and the push doesn't happen.

![Where the gate sits, as a two-row comparison. The usual setup: Claude runs git push with the --no-verify flag, git checks its own hook but the flag switched it off, and the code lands on main with nothing run, because the check lives inside git. Ship Gate: Claude pushes with or without the flag; Ship Gate answers first, before the push command runs, so git is never reached; the push is denied without a fresh pass for that commit, and goes through when every gate is green. It stands outside git, so the flag has nothing left to switch off. The gates are tests, lint, typecheck, build, secret scan, code review, security and user acceptance testing (UAT) sign-off. It covers Claude's pushes to your protected branch, a push hidden in bash -c is not chased, and the gates are switchable per project.](docs/where-the-gate-sits.svg)