GitHub
Releases
Code quality
Security & compliance
Stability
Release & branch safety
What stands between a push and a production release.
Overview
lumioguard reads your release workflows and merge-gating signals to find publish paths that fire without a tag, deploy jobs with no environment approval, and repositories where nothing blocks a direct merge.
What it looks for
- Production deploy jobs with no environment protection rule
- Release automation triggered on every push with no tag or release guard
- Publish tokens passed as CLI arguments, where they land in logs
- No CI workflows, so no status checks exist to gate a merge
- No CODEOWNERS, no Dependabot config
Why it matters
A publish job triggered on every push will eventually ship a half-finished branch to your registry. A deploy job with no environment protection is a production deploy that any contributor can start.
Rules in this check
| What it reports | Fix path |
|---|---|
| No CODEOWNERS file | Pull request |
| No CI workflows — no status checks to gate merges | Guide |
| Production deploy job without environment protection | Guide |
| Automated release triggered on every push without a tag/release guard | Guide |
| Package publish token passed as CLI argument (log-visible) | Pull request |
| No Dependabot config — dependency updates not automated | Pull request |
How the fixes arrive
Pull requestLow-risk changes arrive as a pull request on a lumioguard branch, with a breakage analysis attached. You review and merge it.
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.