Deploy Admin

Caution

Deployment mistakes are irreversible. Pushed tags, published releases, triggered workflows — none undo cleanly. deploy-admin classifies every operation by safety level and requires explicit confirmation before touching anything at SERVICE, DELETE, or PRIVILEGE tier.

Tip

Run /brewtools:deploy setup first. The skill writes CLAUDE.local.md with your GitHub config, workflow inventory, and server targets. The agent reads that file automatically on every task start.

Quick reference

FieldValue
Agent namedeploy-admin
Modelopus
ToolsRead, Write, Edit, Bash, Glob, Grep, AskUserQuestion, WebFetch, WebSearch
Triggers”deploy”, “github actions”, “workflow”, “release”, “ci cd”, “version bump”, “publish”
Safety gateConfirms before MODIFY / SERVICE / DELETE / PRIVILEGE operations

When to use

  • Release a new version — bump semver, generate changelog, commit, tag, push, verify CI green
  • Create or update a workflow — write workflow YAML, add matrix, configure caching, set up GHCR push
  • Monitor CI — check why a run failed, fetch step logs, rerun failed jobs
  • Publish a draft release — review notes, attach assets, flip draft to published
  • Deploy to VPS — dispatch workflow, watch run live, SSH health-check the server after deploy
  • Manage secrets — list names (never values), set from file, clean up stale entries

Examples

# Release a new version with full pipeline
"Release v3.6.0 with changelog from recent commits"

# Investigate a failed run
"Check why the last docs workflow failed and suggest a fix"

# Trigger a deploy and verify it landed
"Trigger deploy-docs workflow and verify health on the VPS"

Flow

  1. Read context

    Reads CLAUDE.local.md for GitHub config, workflow inventory, server targets, and secret names. Verifies gh auth status — wrong user stops everything before touching any resource.

  2. Classify operations

    Every planned command is assigned a safety level: READ (free), CREATE (free), MODIFY (confirm), SERVICE (confirm), DELETE (always confirm), PRIVILEGE (always confirm). Compound pipelines inherit the highest level of any constituent command.

  3. Confirm before mutating

    MODIFY and above: describes exactly what will happen, then calls AskUserQuestion. No mutation runs without an affirmative answer. Emergency stop fires immediately if the wrong repo, branch, or secret exposure is detected.

  4. Execute operations

    Runs gh CLI commands in order — workflow dispatch, release create, secret set, git push —tags, Docker build + push to GHCR. Each command result is captured for the final report.

  5. Verify

    Checks CI run status (gh run list -L 3), release state, and deployment health via SSH. For plugin releases, also verifies the plugin cache updated correctly.

  6. Report

    Outputs a structured table: repository, task, operations executed, highest safety level reached, and per-check verification results. No silent failures.

Internals — safety levels and release pipeline

Safety classification

LevelGateExamples
READfreegh run list/view, gh workflow list, gh release view, gh secret list
CREATEfreeCreate workflow YAML, gh release create --draft
MODIFYconfirmEdit workflow, gh secret set, git commit, git tag
SERVICEconfirmgh workflow run, gh run rerun, git push, git push --tags
DELETEalways confirmgh release delete, gh run cancel, remove workflow file
PRIVILEGEalways confirmgh secret delete, branch protection changes, gh workflow disable

Pipelines (cmd1 | cmd2) and curl | bash patterns inherit PRIVILEGE regardless of base level.

Release pipeline steps

StepCommandLevel
1. Bump versionbash .claude/scripts/bump-version.sh X.Y.ZMODIFY
2. Changeloggit log --oneline vPREV..HEAD → update RELEASE-NOTES.mdMODIFY
3. Commitgit commit -m "vX.Y.Z: summary"MODIFY
4. Taggit tag vX.Y.ZMODIFY
5. Pushgit push && git push --tagsSERVICE
6. Update pluginsbash .claude/scripts/update-plugin.shSERVICE
7. Verify CIgh run list -L 3READ
8. Verify cachegrep '"matcher"' ~/.claude/plugins/cache/.../hooks.jsonREAD

RELEASE-NOTES.md format

## vX.Y.Z (YYYY-MM-DD)

> Docs: [page](https://doc-claude.brewcode.app/plugin/path/) | [page2](...)

### brewcode
#### Fixed / Changed / Added
- **category:** description

The > Docs: line must list pages for every affected skill, agent, or hook. URL pattern: https://doc-claude.brewcode.app/{plugin}/{skills|agents}/{name}/

Docker / GHCR

# Build for linux/amd64 and push
docker build --platform linux/amd64 -t ghcr.io/OWNER/IMAGE:TAG .
docker push ghcr.io/OWNER/IMAGE:TAG

# Multi-tag (version + latest)
docker build -t ghcr.io/OWNER/IMAGE:TAG -t ghcr.io/OWNER/IMAGE:latest .
docker push ghcr.io/OWNER/IMAGE:TAG
docker push ghcr.io/OWNER/IMAGE:latest

SSH deploy

# Health check
ssh -o ConnectTimeout=10 USER@HOST 'uptime && df -h && docker ps'

# Pull and restart
ssh USER@HOST 'cd /opt/app && docker compose pull && docker compose up -d'
🚀

Deploy skill

The skill that configures GitHub integration and writes CLAUDE.local.md for this agent to read.

📟

ssh-admin agent

Companion agent for VPS management — SSH connections, server config, and Docker operations on remote hosts.

🔗

GitHub source

Agent definition with full safety rules and workflow templates.

📄

Brewtools overview

All brewtools skills and agents in one place.

Updating plugins

Use /brewtools:plugin-update to check and update the brewcode plugin suite in one command. See the FAQ for details.