shipit

Production-readiness validator that catches deployment mistakes before you ship.

Inspired by tirith - applying the "guard before execution" philosophy to deployments. Tirith protects your terminal from malicious URLs; shipit protects your production from common deployment pitfalls.

The Problem

You've built your app. Tests pass. CI is green. But are you really ready to ship?

Common deployment mistakes that slip through:

• Forgot to remove console.log statements
• Hardcoded localhost URLs still in the codebase
• API keys accidentally committed in source files
• Source maps exposing your code in production
• Dev dependencies bloating your production bundle
• Security headers not configured

shipit catches these before your users do.

Installation

# Global install
npm install -g shipit-check

# Or run directly with npx
npx shipit-check

Usage

# Check current directory
shipit

# Check specific directory
shipit ./my-app

# Quiet mode (errors only)
shipit --quiet

What It Checks

Check	Description	Severity
Debug Statements	console.log, debugger, DEBUG flags	Warning
Dev URLs	Hardcoded localhost, 127.0.0.1	Error
Exposed Secrets	API keys, tokens, passwords in source	Error
Source Maps	.map files in build directories	Warning
Dependencies	Dev packages in production deps	Warning
Environment	.env.example exists, .env gitignored	Mixed
Security Headers	Helmet/Next.js headers configured	Warning
TODOs	TODO and FIXME comments	Mixed

Example Output

shipit v1.0.0 - Production Readiness Check

Scanning: /home/user/my-app

------------------------------------------------------------

PASSED

  ✓ [secrets] No exposed secrets detected
  ✓ [sourcemaps] No source maps in build directories
  ✓ [env] .env.example file exists
  ✓ [env] .env is gitignored

WARNINGS

  ! [debug] console.log statement found
    src/api/handler.js:42
  ! [todos] TODO comment found
    src/utils/helpers.ts:18

ERRORS

  ✗ [urls] Hardcoded localhost URL
    src/config/api.js:5

------------------------------------------------------------

Summary: 4 passed | 2 warnings | 1 errors

✗ NOT READY TO SHIP

Fix the errors above before deploying to production.

CI/CD Integration

shipit exits with code 1 if errors are found, making it easy to integrate into CI:

# GitHub Actions
- name: Production readiness check
  run: npx shipit-check

# GitLab CI
production-check:
  script:
    - npx shipit-check

Pre-deploy Hook

Add to your deploy script:

{
  "scripts": {
    "predeploy": "shipit",
    "deploy": "your-deploy-command"
  }
}

Configuration

shipit works out of the box with sensible defaults. It automatically:

• Skips node_modules, .git, dist, build directories
• Ignores .env files when scanning for secrets (they're supposed to have secrets)
• Skips config files when checking for localhost URLs
• Handles JS, TS, JSX, TSX, Vue, and Svelte files

Comparison with Similar Tools

Tool	Focus	shipit Difference
ESLint	Code quality	shipit focuses on deployment readiness, not code style
git-secrets	Pre-commit secrets	shipit checks broader deployment concerns
npm audit	Dependency vulns	shipit checks for dev/prod dep misplacement

shipit is not a replacement for these tools - it complements them by focusing specifically on "is this ready to deploy to production?"

Philosophy

"The best time to catch a deployment mistake is before deployment."

shipit follows the principle that catching problems early saves time, money, and reputation. Run it locally, run it in CI, run it before every deploy.

Contributing

Issues and PRs welcome. The goal is to catch real-world deployment mistakes without being overly noisy.

License

MIT