shipcheck-cli 0.1.0__tar.gz

shipcheck_cli-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,38 @@
+name: Bug report
+description: Report a reproducible problem with ShipCheck.
+title: "bug: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Please remove any secrets or sensitive project data before submitting.
+  - type: input
+    id: version
+    attributes:
+      label: ShipCheck version
+      placeholder: "0.1.0"
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: Describe the problem and the expected behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: How can we reproduce it?
+      description: Include the command and a minimal project/configuration example.
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include Python version and operating system.
+    validations:
+      required: true

shipcheck_cli-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,25 @@
+name: Feature request
+description: Suggest an improvement or new capability for ShipCheck.
+title: "feat: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or use case
+      description: What problem would this feature solve?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the behavior or interface you would like.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Describe any alternative approaches you considered.

shipcheck_cli-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Upgrade packaging tools
+        run: python -m pip install --upgrade pip build
+
+      - name: Install project
+        run: python -m pip install -e ".[dev]"
+
+      - name: Lint
+        run: ruff check .
+
+      - name: Test
+        run: pytest -q
+
+      - name: Build package
+        run: python -m build
+
+      - name: Validate wheel metadata
+        run: python -m pip install dist/*.whl --force-reinstall
+
+      - name: CLI smoke test
+        run: shipcheck . --json

shipcheck_cli-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,65 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Validate tag version
+        env:
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          python - <<'PY'
+          import os
+          import tomllib
+
+          with open("pyproject.toml", "rb") as fh:
+              version = tomllib.load(fh)["project"]["version"]
+
+          tag_version = os.environ["TAG_NAME"].removeprefix("v")
+          if version != tag_version:
+              raise SystemExit(
+                  f"Tag version {tag_version!r} does not match pyproject.toml version {version!r}"
+              )
+          PY
+
+      - name: Install build tooling
+        run: python -m pip install --upgrade pip build twine
+
+      - name: Build package
+        run: python -m build
+
+      - name: Validate distributions
+        run: twine check dist/*
+
+      - name: Replace existing GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: gh release delete "$TAG_NAME" --yes || true
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG_NAME: ${{ github.ref_name }}
+        run: gh release create "$TAG_NAME" dist/* --generate-notes --verify-tag
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

shipcheck_cli-0.1.0/.github/workflows/tests.yml

@@ -0,0 +1,24 @@
+name: Tests
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install project
+        run: python -m pip install --upgrade pip && pip install -e ".[dev]"
+      - name: Run tests
+        run: pytest -q
+      - name: Lint
+        run: ruff check .

shipcheck_cli-0.1.0/.gitignore

@@ -0,0 +1,14 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+.env
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+dist/
+build/
+.coverage
+htmlcov/
+.DS_Store

shipcheck_cli-0.1.0/.shipcheck.toml

@@ -0,0 +1,3 @@
+# Optional ShipCheck project policy.
+# The CLI flag --threshold overrides this value.
+threshold = 80

shipcheck_cli-0.1.0/CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+All notable changes to ShipCheck are documented here.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow Semantic Versioning.
+
+## [0.1.0] - 2026-09-09
+
+### Added
+
+- Project, Git, framework, README, `.gitignore`, and environment checks.
+- Dependency manifest and deployment configuration detection.
+- Provider-aware validation for Vercel, Docker, and GitHub Actions.
+- Secret scanning for common credential formats.
+- Weighted deployment-readiness scoring.
+- Configurable readiness thresholds through `.shipcheck.toml` and `--threshold`.
+- Deployment gate mode with a non-zero exit code when readiness fails.
+- Rich terminal reports and JSON output.
+- Automated test coverage and GitHub Actions CI across Python 3.11–3.13.
+- Python package build and CLI smoke-test validation in CI.
+
+[0.1.0]: https://github.com/farukislamyt/ShipCheck/releases/tag/v0.1.0

shipcheck_cli-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,46 @@
+# Contributing to ShipCheck
+
+Thanks for contributing.
+
+## Development setup
+
+ShipCheck requires Python 3.11 or newer.
+
+```bash
+git clone https://github.com/farukislamyt/ShipCheck.git
+cd ShipCheck
+python -m pip install -e ".[dev]"
+```
+
+## Before opening a pull request
+
+Run the same core checks used by CI:
+
+```bash
+ruff check .
+pytest -q
+python -m build
+```
+
+Keep changes focused and add or update tests for behavior changes.
+
+## Pull requests
+
+Please include:
+
+- A concise description of the problem and solution.
+- Tests covering new or changed behavior.
+- Documentation updates when the CLI, configuration, or user-facing behavior changes.
+- Any compatibility or migration considerations.
+
+Do not commit credentials, API keys, private keys, `.env` files containing secrets, build artifacts, or local virtual environments.
+
+## Commit and code style
+
+Use clear, imperative commit messages such as `feat: add provider validation` or `fix: handle malformed workflow YAML`.
+
+Follow the existing Python style and Ruff configuration in `pyproject.toml`.
+
+## Security issues
+
+Do not disclose security vulnerabilities in public issues. Follow the process in [SECURITY.md](SECURITY.md).

shipcheck_cli-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Faruk Islam
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

shipcheck_cli-0.1.0/PKG-INFO

@@ -0,0 +1,118 @@
+Metadata-Version: 2.5
+Name: shipcheck-cli
+Version: 0.1.0
+Summary: Pre-deployment health checks for software projects.
+Author: Faruk Islam
+License: MIT
+License-File: LICENSE
+Requires-Python: >=3.11
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.7
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# ShipCheck
+
+> Pre-deployment health checks for modern software projects.
+
+ShipCheck is a developer-first CLI that scans a project before deployment and highlights configuration problems, missing files, exposed secrets, dependency issues, and other deployment risks.
+
+## Status
+
+🚀 v0.1.0 — first public release.
+
+## What it checks
+
+- Git repository and working-tree status
+- Framework detection
+- `.gitignore` and environment configuration
+- Secret detection
+- Dependency manifests
+- Deployment configuration
+- Provider-specific deployment configuration
+- Tests and CI/CD signals
+- Project documentation
+
+## Installation
+
+### From PyPI
+
+```bash
+python -m pip install shipcheck-cli
+```
+
+### From source
+
+```bash
+git clone https://github.com/farukislamyt/ShipCheck.git
+cd ShipCheck
+python -m pip install -e ".[dev]"
+```
+
+## Usage
+
+Run a readiness report:
+
+```bash
+shipcheck .
+```
+
+Machine-readable JSON output:
+
+```bash
+shipcheck . --json
+```
+
+Use the deployment gate in CI/CD. It exits with status `1` when a check fails or the readiness score is below the configured threshold:
+
+```bash
+shipcheck . --gate
+```
+
+Override the default readiness threshold of 80:
+
+```bash
+shipcheck . --gate --threshold 90
+```
+
+## Configuration
+
+Create `.shipcheck.toml` in the project root to persist the readiness threshold:
+
+```toml
+[shipcheck]
+threshold = 80
+```
+
+The CLI `--threshold` option takes precedence over the configuration file.
+
+## Release process
+
+Releases are tag-driven. The GitHub Actions release workflow validates that the tag version matches `pyproject.toml`, builds the package, runs `twine check`, creates a GitHub Release, and publishes distributions to PyPI using trusted publishing.
+
+For example:
+
+```bash
+git tag v0.1.0
+git push origin v0.1.0
+```
+
+See [CHANGELOG.md](CHANGELOG.md) for release history.
+
+## Development
+
+Install development dependencies and run the checks locally:
+
+```bash
+python -m pip install -e ".[dev]"
+ruff check .
+pytest -q
+python -m build
+```
+
+## License
+
+MIT License.

shipcheck_cli-0.1.0/README.md

@@ -0,0 +1,102 @@
+# ShipCheck
+
+> Pre-deployment health checks for modern software projects.
+
+ShipCheck is a developer-first CLI that scans a project before deployment and highlights configuration problems, missing files, exposed secrets, dependency issues, and other deployment risks.
+
+## Status
+
+🚀 v0.1.0 — first public release.
+
+## What it checks
+
+- Git repository and working-tree status
+- Framework detection
+- `.gitignore` and environment configuration
+- Secret detection
+- Dependency manifests
+- Deployment configuration
+- Provider-specific deployment configuration
+- Tests and CI/CD signals
+- Project documentation
+
+## Installation
+
+### From PyPI
+
+```bash
+python -m pip install shipcheck-cli
+```
+
+### From source
+
+```bash
+git clone https://github.com/farukislamyt/ShipCheck.git
+cd ShipCheck
+python -m pip install -e ".[dev]"
+```
+
+## Usage
+
+Run a readiness report:
+
+```bash
+shipcheck .
+```
+
+Machine-readable JSON output:
+
+```bash
+shipcheck . --json
+```
+
+Use the deployment gate in CI/CD. It exits with status `1` when a check fails or the readiness score is below the configured threshold:
+
+```bash
+shipcheck . --gate
+```
+
+Override the default readiness threshold of 80:
+
+```bash
+shipcheck . --gate --threshold 90
+```
+
+## Configuration
+
+Create `.shipcheck.toml` in the project root to persist the readiness threshold:
+
+```toml
+[shipcheck]
+threshold = 80
+```
+
+The CLI `--threshold` option takes precedence over the configuration file.
+
+## Release process
+
+Releases are tag-driven. The GitHub Actions release workflow validates that the tag version matches `pyproject.toml`, builds the package, runs `twine check`, creates a GitHub Release, and publishes distributions to PyPI using trusted publishing.
+
+For example:
+
+```bash
+git tag v0.1.0
+git push origin v0.1.0
+```
+
+See [CHANGELOG.md](CHANGELOG.md) for release history.
+
+## Development
+
+Install development dependencies and run the checks locally:
+
+```bash
+python -m pip install -e ".[dev]"
+ruff check .
+pytest -q
+python -m build
+```
+
+## License
+
+MIT License.

shipcheck_cli-0.1.0/SECURITY.md

@@ -0,0 +1,30 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are provided for the latest released version of ShipCheck. Development versions on `main` may change without notice.
+
+| Version | Supported |
+| --- | --- |
+| 0.1.x | Yes |
+| < 0.1.0 | No |
+
+## Reporting a vulnerability
+
+Please do **not** report security vulnerabilities through public GitHub issues.
+
+Instead, use GitHub's private vulnerability reporting feature for this repository when available. Include:
+
+- A clear description of the vulnerability.
+- Steps to reproduce or a minimal proof of concept.
+- The affected version or commit.
+- Any relevant logs, stack traces, or configuration details.
+- The potential security impact.
+
+Please avoid including real credentials, API keys, private keys, personal data, or other sensitive information in the report.
+
+We will acknowledge valid reports and coordinate a fix and disclosure timeline with the reporter.
+
+## Secret-scanning note
+
+ShipCheck is designed to identify common credential patterns before deployment. Its scanner is heuristic and should not be treated as a replacement for dedicated secret-management or secret-scanning systems.

shipcheck_cli-0.1.0/pyproject.toml

@@ -0,0 +1,38 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "shipcheck-cli"
+version = "0.1.0"
+description = "Pre-deployment health checks for software projects."
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "MIT" }
+authors = [{ name = "Faruk Islam" }]
+dependencies = [
+    "typer>=0.12",
+    "rich>=13.7",
+    "PyYAML>=6.0",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0",
+    "ruff>=0.6",
+]
+
+[project.scripts]
+shipcheck = "shipcheck.cli:app"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/shipcheck"]
+
+[tool.ruff]
+line-length = 120
+
+target-version = "py311"
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-ra"

shipcheck_cli-0.1.0/src/shipcheck/__init__.py

@@ -0,0 +1,3 @@
+"""ShipCheck package."""
+
+__version__ = "0.1.0"

shipcheck_cli-0.1.0/src/shipcheck/cli.py

@@ -0,0 +1,311 @@
+from __future__ import annotations
+
+import json
+import re
+import subprocess
+from pathlib import Path
+
+import typer
+import yaml
+from rich.console import Console
+from rich.panel import Panel
+
+app = typer.Typer(help="Pre-deployment health checks for software projects.")
+console = Console()
+PATH_ARGUMENT = typer.Argument(None, exists=True, file_okay=False, dir_okay=True)
+
+SECRET_PATTERNS = {
+    "AWS access key": re.compile(r"\bAKIA[0-9A-Z]{16}\b"),
+    "GitHub token": re.compile(r"\bgh[pousr]_[A-Za-z0-9_]{20,}\b"),
+    "Private key": re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----"),
+    "Google API key": re.compile(r"\bAIza[0-9A-Za-z_-]{35}\b"),
+    "Slack token": re.compile(r"\bxox[baprs]-[0-9A-Za-z-]{10,}\b"),
+    "Stripe live key": re.compile(r"\bsk_live_[0-9A-Za-z]{16,}\b"),
+    "Generic API key": re.compile(r"(?i)(api[_-]?key|secret[_-]?key|access[_-]?token)\s*[:=]\s*[\"']([^\"']{16,})[\"']"),
+}
+
+IGNORED_DIRS = {".git", ".venv", "venv", "node_modules", "__pycache__", ".pytest_cache", "dist", "build", ".mypy_cache", ".ruff_cache"}
+SCANNABLE_SUFFIXES = {".py", ".js", ".jsx", ".ts", ".tsx", ".json", ".yaml", ".yml", ".toml", ".ini", ".env", ".txt", ".cfg", ".conf"}
+PLACEHOLDER_VALUES = {"example-placeholder", "changeme", "change-me", "your-api-key", "your-secret-key", "replace-me"}
+
+CHECK_WEIGHTS = {
+    "Project directory": 5,
+    "Git repository": 10,
+    "Git working tree": 10,
+    "Framework detection": 5,
+    "README": 5,
+    ".gitignore": 10,
+    "Environment configuration": 10,
+    "Dependency manifest": 10,
+    "Deployment config": 10,
+    "Provider validation": 5,
+    "Tests": 10,
+    "Secrets scan": 10,
+}
+DEFAULT_THRESHOLD = 80
+
+
+def _git_clean(path: Path) -> str:
+    try:
+        result = subprocess.run(["git", "-C", str(path), "status", "--porcelain"], capture_output=True, text=True, timeout=5, check=False)
+    except (OSError, subprocess.SubprocessError):
+        return "WARN"
+    if result.returncode != 0:
+        return "WARN"
+    return "PASS" if not result.stdout.strip() else "WARN"
+
+
+def _has_dependency_manifest(path: Path) -> str:
+    manifests = ("pyproject.toml", "requirements.txt", "poetry.lock", "uv.lock", "package.json", "package-lock.json", "pnpm-lock.yaml", "yarn.lock", "go.mod", "go.sum", "Cargo.toml", "Cargo.lock")
+    return "PASS" if any((path / name).exists() for name in manifests) else "WARN"
+
+
+def _has_tests(path: Path) -> str:
+    if any((path / name).is_dir() for name in ("tests", "test", "spec")):
+        return "PASS"
+    return "PASS" if any(p.name.startswith(("test_", "spec_")) for p in path.rglob("*") if p.is_file()) else "WARN"
+
+
+def _framework(path: Path) -> str:
+    if (path / "manage.py").exists():
+        return "Django"
+    if (path / "pyproject.toml").exists() or (path / "requirements.txt").exists():
+        try:
+            files = [p for p in (path / "pyproject.toml", path / "requirements.txt") if p.exists()]
+            text = "\n".join(p.read_text(encoding="utf-8", errors="ignore") for p in files).lower()
+            for name, label in (("fastapi", "FastAPI"), ("flask", "Flask"), ("django", "Django")):
+                if name in text:
+                    return label
+        except OSError:
+            pass
+        return "Python"
+    package = path / "package.json"
+    if package.exists():
+        try:
+            data = json.loads(package.read_text(encoding="utf-8", errors="ignore"))
+            deps = {**data.get("dependencies", {}), **data.get("devDependencies", {})}
+            for name, label in (("next", "Next.js"), ("react", "React"), ("vue", "Vue"), ("express", "Express")):
+                if name in deps:
+                    return label
+        except (OSError, json.JSONDecodeError):
+            pass
+        return "Node.js"
+    return "Unknown"
+
+
+def _env_status(path: Path) -> str:
+    env = path / ".env"
+    template = next((path / name for name in (".env.example", ".env.template") if (path / name).exists()), None)
+    if not env.exists() and template is None:
+        return "WARN"
+    if not env.exists():
+        return "WARN"
+    if template is None:
+        return "PASS"
+    try:
+        env_keys = {line.split("=", 1)[0].strip() for line in env.read_text(errors="ignore").splitlines() if "=" in line and line.strip() and not line.lstrip().startswith("#")}
+        template_keys = {line.split("=", 1)[0].strip() for line in template.read_text(errors="ignore").splitlines() if "=" in line and line.strip() and not line.lstrip().startswith("#")}
+        return "PASS" if template_keys <= env_keys else "WARN"
+    except OSError:
+        return "WARN"
+
+
+def _deployment_files(path: Path) -> str:
+    return "PASS" if _deployment_provider(path) != "Unknown" else "WARN"
+
+
+def _deployment_provider(path: Path) -> str:
+    if (path / "vercel.json").exists() or (path / ".vercel").is_dir():
+        return "Vercel"
+    if any((path / name).exists() for name in ("Dockerfile", "docker-compose.yml", "docker-compose.yaml", "compose.yml", "compose.yaml")):
+        return "Docker"
+    if (path / "Procfile").exists():
+        return "Procfile-compatible"
+    workflows = path / ".github" / "workflows"
+    if workflows.is_dir() and any(p.suffix in {".yml", ".yaml"} for p in workflows.iterdir() if p.is_file()):
+        return "GitHub Actions"
+    return "Unknown"
+
+
+def _read_text(path: Path) -> str | None:
+    try:
+        return path.read_text(encoding="utf-8", errors="ignore")
+    except OSError:
+        return None
+
+
+def _load_yaml_mapping(path: Path) -> dict | None:
+    text = _read_text(path)
+    if text is None:
+        return None
+    try:
+        data = yaml.safe_load(text)
+    except yaml.YAMLError:
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def _validate_vercel(path: Path) -> str:
+    config = path / "vercel.json"
+    if not config.exists():
+        return "WARN"
+    try:
+        data = json.loads(config.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return "FAIL"
+    return "PASS" if isinstance(data, dict) else "FAIL"
+
+
+def _validate_docker(path: Path) -> str:
+    dockerfile = path / "Dockerfile"
+    if dockerfile.exists():
+        text = _read_text(dockerfile)
+        if text is None:
+            return "WARN"
+        return "PASS" if re.search(r"(?m)^\s*FROM\s+\S+", text) else "FAIL"
+    compose = next((path / name for name in ("docker-compose.yml", "docker-compose.yaml", "compose.yml", "compose.yaml") if (path / name).exists()), None)
+    if compose is None:
+        return "WARN"
+    data = _load_yaml_mapping(compose)
+    return "PASS" if data is not None and isinstance(data.get("services"), dict) and data["services"] else "FAIL"
+
+
+def _validate_github_actions(path: Path) -> str:
+    workflows = path / ".github" / "workflows"
+    files = [p for p in workflows.iterdir() if p.is_file() and p.suffix in {".yml", ".yaml"}] if workflows.is_dir() else []
+    if not files:
+        return "WARN"
+    for workflow in files:
+        data = _load_yaml_mapping(workflow)
+        if data is None:
+            return "FAIL"
+        if not isinstance(data.get("name"), str) or not data.get("name", "").strip():
+            return "FAIL"
+        if "on" not in data and True not in data:
+            return "FAIL"
+        jobs = data.get("jobs")
+        if not isinstance(jobs, dict) or not jobs:
+            return "FAIL"
+    return "PASS"
+
+
+def _provider_validation(path: Path, provider: str) -> str:
+    if provider == "Vercel":
+        return _validate_vercel(path)
+    if provider == "Docker":
+        return _validate_docker(path)
+    if provider == "GitHub Actions":
+        return _validate_github_actions(path)
+    if provider == "Procfile-compatible":
+        procfile = path / "Procfile"
+        text = _read_text(procfile)
+        return "PASS" if text and any(re.match(r"^\s*[A-Za-z][A-Za-z0-9_-]*\s*:", line) for line in text.splitlines()) else "FAIL"
+    return "WARN"
+
+
+def _secret_findings(path: Path) -> list[str]:
+    findings: list[str] = []
+    seen: set[tuple[str, str]] = set()
+    for file in path.rglob("*"):
+        if not file.is_file() or any(part in IGNORED_DIRS for part in file.parts) or file.suffix.lower() not in SCANNABLE_SUFFIXES:
+            continue
+        try:
+            text = file.read_text(encoding="utf-8", errors="ignore")
+        except OSError:
+            continue
+        for label, pattern in SECRET_PATTERNS.items():
+            match = pattern.search(text)
+            if match and not (label == "Generic API key" and match.group(2).strip().lower() in PLACEHOLDER_VALUES):
+                finding = (str(file.relative_to(path)), label)
+                if finding not in seen:
+                    findings.append(f"{finding[0]}: {finding[1]}")
+                    seen.add(finding)
+    return findings
+
+
+def check_project(path: Path) -> list[tuple[str, str]]:
+    provider = _deployment_provider(path)
+    return [
+        ("Project directory", "PASS" if path.is_dir() else "FAIL"),
+        ("Git repository", "PASS" if (path / ".git").exists() else "WARN"),
+        ("Git working tree", _git_clean(path) if (path / ".git").exists() else "WARN"),
+        ("Framework detection", "PASS" if _framework(path) != "Unknown" else "WARN"),
+        ("README", "PASS" if any((path / name).exists() for name in ("README.md", "README.rst", "README")) else "WARN"),
+        (".gitignore", "PASS" if (path / ".gitignore").exists() else "WARN"),
+        ("Environment configuration", _env_status(path)),
+        ("Dependency manifest", _has_dependency_manifest(path)),
+        ("Deployment config", _deployment_files(path)),
+        ("Provider validation", _provider_validation(path, provider)),
+        ("Tests", _has_tests(path)),
+        ("Secrets scan", "FAIL" if _secret_findings(path) else "PASS"),
+    ]
+
+
+def calculate_score(checks: list[tuple[str, str]]) -> int:
+    total = sum(CHECK_WEIGHTS.get(name, 0) for name, _ in checks)
+    earned = sum(CHECK_WEIGHTS.get(name, 0) for name, status in checks if status == "PASS")
+    return round((earned / total) * 100) if total else 0
+
+
+def is_deployable(checks: list[tuple[str, str]], score: int | None = None, threshold: int = DEFAULT_THRESHOLD) -> bool:
+    if any(status == "FAIL" for _, status in checks):
+        return False
+    return (calculate_score(checks) if score is None else score) >= threshold
+
+
+def _configured_threshold(path: Path) -> int:
+    config = path / ".shipcheck.toml"
+    if not config.exists():
+        return DEFAULT_THRESHOLD
+    try:
+        for line in config.read_text(encoding="utf-8", errors="ignore").splitlines():
+            if line.strip().startswith("threshold") and "=" in line:
+                value = int(line.split("=", 1)[1].strip())
+                if 0 <= value <= 100:
+                    return value
+    except (OSError, ValueError):
+        pass
+    return DEFAULT_THRESHOLD
+
+
+@app.command()
+def scan(
+    path: Path | None = PATH_ARGUMENT,
+    json_output: bool = typer.Option(False, "--json", help="Print machine-readable JSON."),
+    gate: bool = typer.Option(False, "--gate", help="Exit with code 1 when the deployment gate fails."),
+    threshold: int | None = typer.Option(None, min=0, max=100, help="Minimum readiness score required by --gate."),
+) -> None:
+    """Scan PATH and report deployment readiness checks."""
+    path = (path or Path(".")).resolve()
+    checks = check_project(path)
+    secrets = _secret_findings(path)
+    score = calculate_score(checks)
+    configured_threshold = _configured_threshold(path)
+    effective_threshold = configured_threshold if threshold is None else threshold
+    provider = _deployment_provider(path)
+    deployable = is_deployable(checks, score, effective_threshold)
+    payload = {"project": path.name, "framework": _framework(path), "deployment_provider": provider, "score": score, "threshold": effective_threshold, "deployable": deployable, "checks": [{"name": n, "status": s} for n, s in checks], "secret_findings": secrets}
+
+    if json_output:
+        typer.echo(json.dumps(payload, indent=2))
+    else:
+        console.print(Panel.fit("[bold]ShipCheck[/bold]\nPre-deployment health check"))
+        console.print(f"\n[bold]Project:[/bold] {path.name}")
+        console.print(f"[bold]Framework:[/bold] {_framework(path)}")
+        console.print(f"[bold]Deployment target:[/bold] {provider}\n")
+        for name, status in checks:
+            icon = {"PASS": "[green]✓[/green]", "WARN": "[yellow]⚠[/yellow]", "FAIL": "[red]✗[/red]"}[status]
+            console.print(f"  {icon} {name}")
+        if secrets:
+            console.print("\n[bold red]Potential secrets:[/bold red]")
+            for finding in secrets[:10]:
+                console.print(f"  [red]•[/red] {finding}")
+        verdict = "READY TO DEPLOY" if deployable else "BLOCKED"
+        console.print(f"\n[bold]Deployment Readiness:[/bold] {score}% / {effective_threshold}% — {verdict}")
+
+    if gate and not deployable:
+        raise typer.Exit(code=1)
+
+
+if __name__ == "__main__":
+    app()

shipcheck_cli-0.1.0/tests/test_checks.py

@@ -0,0 +1,19 @@
+from pathlib import Path
+
+from shipcheck.cli import _secret_findings, check_project
+
+
+def test_secret_detection(tmp_path: Path) -> None:
+    (tmp_path / "config.py").write_text('API_KEY = "super-secret-value-12345"')
+    findings = _secret_findings(tmp_path)
+    assert findings
+    assert "Generic API key" in findings[0]
+
+
+def test_dependency_and_tests_checks(tmp_path: Path) -> None:
+    (tmp_path / "pyproject.toml").write_text("[project]\nname='demo'\n")
+    (tmp_path / "tests").mkdir()
+    results = dict(check_project(tmp_path))
+    assert results["Dependency manifest"] == "PASS"
+    assert results["Tests"] == "PASS"
+    assert results["Secrets scan"] == "PASS"

shipcheck_cli-0.1.0/tests/test_cli.py

@@ -0,0 +1,191 @@
+from pathlib import Path
+
+from typer.testing import CliRunner
+
+from shipcheck.cli import (
+    _deployment_provider,
+    _env_status,
+    _framework,
+    _provider_validation,
+    _secret_findings,
+    app,
+    calculate_score,
+    check_project,
+    is_deployable,
+)
+
+runner = CliRunner()
+
+
+def test_project_checks(tmp_path: Path) -> None:
+    (tmp_path / ".git").mkdir()
+    (tmp_path / "README.md").write_text("# Demo", encoding="utf-8")
+    (tmp_path / ".gitignore").write_text("__pycache__/", encoding="utf-8")
+    (tmp_path / "pyproject.toml").write_text('[project]\nname = "demo"\ndependencies = ["typer"]\n', encoding="utf-8")
+    (tmp_path / "tests").mkdir()
+
+    results = dict(check_project(tmp_path))
+
+    assert results["Project directory"] == "PASS"
+    assert results["Git repository"] == "PASS"
+    assert results["README"] == "PASS"
+    assert results[".gitignore"] == "PASS"
+    assert results["Dependency manifest"] == "PASS"
+    assert results["Tests"] == "PASS"
+
+
+def test_framework_detection(tmp_path: Path) -> None:
+    (tmp_path / "requirements.txt").write_text("fastapi>=0.1", encoding="utf-8")
+    assert _framework(tmp_path) == "FastAPI"
+
+
+def test_environment_template_requires_matching_keys(tmp_path: Path) -> None:
+    (tmp_path / ".env.example").write_text("DATABASE_URL=\nAPI_KEY=\n", encoding="utf-8")
+    (tmp_path / ".env").write_text("DATABASE_URL=test\n", encoding="utf-8")
+    assert _env_status(tmp_path) == "WARN"
+
+    (tmp_path / ".env").write_text("DATABASE_URL=test\nAPI_KEY=test\n", encoding="utf-8")
+    assert _env_status(tmp_path) == "PASS"
+
+
+def test_secret_scanner_detects_common_secret(tmp_path: Path) -> None:
+    source = tmp_path / "config.py"
+    aws_key = "AKIA" + "1234567890ABCDEF"
+    source.write_text(f'AWS_ACCESS_KEY = "{aws_key}"\n', encoding="utf-8")
+    findings = _secret_findings(tmp_path)
+    assert any("AWS access key" in finding for finding in findings)
+
+
+def test_secret_scanner_detects_provider_credentials(tmp_path: Path) -> None:
+    source = tmp_path / "config.py"
+    google_key = "AIza" + "SyA12345678901234567890123456789012"
+    slack_token = "xoxb-" + "1234567890-abcdefghijk"
+    stripe_key = "sk_live_" + "1234567890abcdef"
+    source.write_text(
+        f'GOOGLE = "{google_key}"\n'
+        f'SLACK = "{slack_token}"\n'
+        f'STRIPE = "{stripe_key}"\n',
+        encoding="utf-8",
+    )
+    findings = _secret_findings(tmp_path)
+    assert any("Google API key" in finding for finding in findings)
+    assert any("Slack token" in finding for finding in findings)
+    assert any("Stripe live key" in finding for finding in findings)
+
+
+def test_secret_scanner_ignores_venv_and_build_artifacts(tmp_path: Path) -> None:
+    github_token = "ghp_" + "123456789012345678901234567890"
+    for dirname in (".venv", "node_modules", "dist", "build", ".git"):
+        ignored = tmp_path / dirname / "secrets.py"
+        ignored.parent.mkdir()
+        ignored.write_text(f'TOKEN = "{github_token}"', encoding="utf-8")
+    assert _secret_findings(tmp_path) == []
+
+
+def test_secret_scanner_deduplicates_findings(tmp_path: Path) -> None:
+    source = tmp_path / "config.py"
+    github_token = "ghp_" + "123456789012345678901234567890"
+    source.write_text(f'TOKEN = "{github_token}"\n', encoding="utf-8")
+    assert _secret_findings(tmp_path) == ["config.py: GitHub token"]
+
+
+def test_secret_scanner_ignores_short_generic_values(tmp_path: Path) -> None:
+    source = tmp_path / "config.py"
+    source.write_text('API_KEY = "example-placeholder"\n', encoding="utf-8")
+    assert _secret_findings(tmp_path) == []
+
+
+def test_weighted_score_uses_check_weights() -> None:
+    checks = [("Tests", "PASS"), ("README", "WARN")]
+    assert calculate_score(checks) == 67
+
+
+def test_secret_failure_blocks_deployment() -> None:
+    checks = [("Secrets scan", "FAIL"), ("Tests", "PASS")]
+    assert is_deployable(checks) is False
+
+
+def test_threshold_blocks_low_score() -> None:
+    checks = [("Tests", "PASS"), ("README", "WARN")]
+    assert is_deployable(checks, score=75, threshold=80) is False
+    assert is_deployable(checks, score=75, threshold=70) is True
+
+
+def test_deployment_provider_detection(tmp_path: Path) -> None:
+    (tmp_path / "vercel.json").write_text("{}", encoding="utf-8")
+    assert _deployment_provider(tmp_path) == "Vercel"
+
+    (tmp_path / "vercel.json").unlink()
+    (tmp_path / "Dockerfile").write_text("FROM python:3.11", encoding="utf-8")
+    assert _deployment_provider(tmp_path) == "Docker"
+
+    (tmp_path / "Dockerfile").unlink()
+    workflows = tmp_path / ".github" / "workflows"
+    workflows.mkdir(parents=True)
+    (workflows / "ci.yml").write_text("name: CI", encoding="utf-8")
+    assert _deployment_provider(tmp_path) == "GitHub Actions"
+
+
+def test_vercel_config_validation(tmp_path: Path) -> None:
+    (tmp_path / "vercel.json").write_text('{"buildCommand": "npm run build"}', encoding="utf-8")
+    assert _provider_validation(tmp_path, "Vercel") == "PASS"
+    (tmp_path / "vercel.json").write_text('{invalid', encoding="utf-8")
+    assert _provider_validation(tmp_path, "Vercel") == "FAIL"
+
+
+def test_dockerfile_validation(tmp_path: Path) -> None:
+    (tmp_path / "Dockerfile").write_text("FROM python:3.11\nCMD [\"python\", \"app.py\"]", encoding="utf-8")
+    assert _provider_validation(tmp_path, "Docker") == "PASS"
+    (tmp_path / "Dockerfile").write_text("CMD [\"python\", \"app.py\"]", encoding="utf-8")
+    assert _provider_validation(tmp_path, "Docker") == "FAIL"
+
+
+def test_compose_yaml_validation(tmp_path: Path) -> None:
+    (tmp_path / "compose.yml").write_text("services:\n  app:\n    image: python:3.11\n", encoding="utf-8")
+    assert _provider_validation(tmp_path, "Docker") == "PASS"
+    (tmp_path / "compose.yml").write_text("services:\n  app: [\n", encoding="utf-8")
+    assert _provider_validation(tmp_path, "Docker") == "FAIL"
+
+
+def test_github_actions_validation(tmp_path: Path) -> None:
+    workflows = tmp_path / ".github" / "workflows"
+    workflows.mkdir(parents=True)
+    workflow = workflows / "deploy.yml"
+    workflow.write_text("name: Deploy\non: push\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n", encoding="utf-8")
+    assert _provider_validation(tmp_path, "GitHub Actions") == "PASS"
+    workflow.write_text("name: Deploy\non: [push\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n", encoding="utf-8")
+    assert _provider_validation(tmp_path, "GitHub Actions") == "FAIL"
+    workflow.write_text("name: Deploy\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n", encoding="utf-8")
+    assert _provider_validation(tmp_path, "GitHub Actions") == "FAIL"
+
+
+def test_provider_validation_is_reported_and_weighted(tmp_path: Path) -> None:
+    (tmp_path / "Dockerfile").write_text("CMD [\"python\", \"app.py\"]", encoding="utf-8")
+    results = dict(check_project(tmp_path))
+    assert results["Provider validation"] == "FAIL"
+    assert calculate_score([("Provider validation", "PASS")]) == 100
+
+
+def test_gate_exits_nonzero_when_blocked(tmp_path: Path) -> None:
+    result = runner.invoke(app, [str(tmp_path), "--gate", "--json"])
+    assert result.exit_code == 1
+
+
+def test_cli_threshold_override(tmp_path: Path) -> None:
+    result = runner.invoke(app, [str(tmp_path), "--threshold", "0", "--json"])
+    assert result.exit_code == 0
+    assert '"threshold": 0' in result.stdout
+    assert '"deployable": true' in result.stdout
+
+
+def test_json_output_is_blocked_for_empty_project(tmp_path: Path) -> None:
+    result = runner.invoke(app, [str(tmp_path), "--json"])
+    assert result.exit_code == 0
+    assert '"deployable": false' in result.stdout
+
+
+def test_json_output_includes_provider(tmp_path: Path) -> None:
+    (tmp_path / "vercel.json").write_text("{}", encoding="utf-8")
+    result = runner.invoke(app, [str(tmp_path), "--json"])
+    assert result.exit_code == 0
+    assert '"deployment_provider": "Vercel"' in result.stdout