Use case · Deploy and remote operations

Add a review floor to deploy pipelines and remote operations

Put production deploys, CI run administration, and remote-execution steps behind a review decision before they run.

Deploy routines mix safe reads with irreversible actions: promoting a production build, deleting a project, cancelling workflow runs, and running shell commands on a remote host. The catalog documents reviewed operations for each of these surfaces, so a workspace can route exactly the irreversible ones through Guard review while ordinary steps keep running.

Evidence grade: reviewed catalog facts · Last reviewed 2026-09-12

Every step below references coverage documented in the HOL Guard extension catalog. These workflows are derived from reviewed catalog facts, not independently run or benchmarked — verify the result in your own setup before relying on it.

When this is not the right fit

Skip this workflow if

  • The pipeline mutates Kubernetes clusters — the cluster-operations workflow covers that surface instead.
  • Your deploy tool has no documented operations in the catalog; these entries do not claim coverage for tools they do not list.

Prerequisites

Before you start

  • Guard is installed on the machine that runs the deploy commands.
  • You know which platform CLIs your pipeline invokes (for example vercel, gh, ssh, rsync).

Steps

The workflow

  1. 1

    Review what production-change coverage governs

    The Vercel entry reviews deployment, promotion, and rollback of Vercel production deployments, plus removal of Vercel deployments or projects. Production changes are cataloged as high-severity review operations and project or deployment removal as critical.

    Vercel command protectionTry this coverage Coverage details
  2. 2

    Cover CI run administration

    The GitHub Actions entry reviews cancellation or deletion of workflow runs and disabling a workflow through the GitHub CLI (gh run cancel, gh run delete, gh workflow disable).

    GitHub Actions command protectionTry this coverage Coverage details
  3. 3

    Cover remote shell steps

    The SSH entry reviews SSH invocations that explicitly execute a remote command after the destination, and options that configure local, host-key, proxy, or remote shell commands.

    SSH remote execution protectionTry this coverage Coverage details
  4. 4

    Flag destructive sync flags

    The rsync entry reviews options that delete destination data or remove synchronized source files (--delete and its variants), plus commands that override the remote-side shell (--rsync-path, --rsh, -e).

    Rsync deletion protectionTry this coverage Coverage details

Expected result

What the documented coverage should do

Deploy, CI, and remote steps that match the reviewed operations pause for a Guard review decision before executing. Documented safe variants such as --help and --dry-run stay outside these rules, and everything else follows the workspace Guard policy.

Limitations

What this workflow does not claim

  • Coverage is limited to the reviewed operations in the catalog — a deploy tool without documented operations is not covered by these entries.
  • Per the catalog’s stated limitations, coverage is limited to the reviewed operations and the surrounding Guard policy; a listing is not a security guarantee.

Coverage referenced

Extensions in this workflow