vibe-ship

vibe-ship: production-ready Docker, CI/CD and deployment for any app (Claude Code skill)

vibe-ship is an open-source Claude Code skill that turns any codebase into a deployable, hardened application. It detects your stack from the repo, writes the Dockerfile, .dockerignore, compose.yaml, .env.example, GitHub Actions or GitLab CI pipeline, and platform config (Kubernetes, Fly.io, Render, Railway, Cloud Run, AWS, Azure, VPS). It then checks everything with a 93-rule static auditor and real docker build runs before handing over.

You bring the vibe. vibe-ship brings the infrastructure, and proves it works.

Built and maintained by Sudais Khalid.

Quick start

/plugin marketplace add sudais-khalid/vibe-ship
/plugin install vibe-ship@vibe-ship

Then, in any project, just say:

"vibe ship this" · "dockerize this app" · "make this production-ready" · "deploy this to Fly.io" · "audit my Dockerfile"

Other install options are under Install.

What you get

Supported stacks

Detection is deterministic (scripts/detect.py reads manifests and lockfiles, it doesn't guess), and every stack has a tested template.

Monorepos: Turborepo, Nx, pnpm/Yarn/npm workspaces, plus any frontend/ + backend/ layout, with one image per deployable service.

Deploy targets

The auditor: 93 rules, no dependencies

scripts/audit.py is a standalone static analyzer for deployment configuration. It runs anywhere Python 3.8+ runs, needs no Docker daemon or network, and is useful on its own, with or without Claude.

python3 scripts/audit.py --path .                       # scored report
python3 scripts/audit.py --path . --fail-on high        # CI gate (exit 1)
python3 scripts/audit.py --path . --format sarif        # GitHub code scanning
python3 scripts/audit.py --path . --format markdown     # PR comment / docs
python3 scripts/audit.py --list-rules                   # full catalog

====================================================================
VIBE-SHIP AUDIT  v2.0.0   score 0/100  grade F
====================================================================
[CRITICAL] VS-G010  .github/workflows/ci.yml:12
  Issue: pull_request_target checks out untrusted PR code
[CRITICAL] VS-D011  Dockerfile:1
  Issue: No USER in final stage - container runs as root
[HIGH] VS-D020  Dockerfile:9
  Issue: HEALTHCHECK uses a tool that does not exist in the final image: 'curl' is not installed in python:3.14-slim
[HIGH] VS-C061  compose.yaml:14
  Issue: Postgres 18+ volume mounted at the old /var/lib/postgresql/data path

What it checks:

• Dockerfile: base image pinning, root user (following USER through multi-stage chains), secrets in ENV/ARG/COPY, curl | sh, a HEALTHCHECK that can't run in the final image, shell-form CMD (no SIGTERM), npm start as PID 1, dev servers in production, lockfile-ignoring installs, layer-cache busting, apt/apk/pip hygiene.
• .dockerignore: missing file, .env / .git / node_modules leaks.
• Compose: privileged mode, Docker socket mounts, host namespaces, dangerous capabilities, hardcoded credentials, database ports exposed on all interfaces, stateful services without volumes, the Postgres 18 data-dir change, missing healthchecks / readiness conditions / restart policies / limits / log rotation.
• GitHub Actions: unpinned or branch-pinned actions, deprecated actions (actions-rs, set-output), pull_request_target pwn requests, script injection via ${{ github.event.* }}, missing or excessive permissions, literal secrets, pushes from PRs, missing tests before deploy, no scanning, no SBOM/provenance.
• GitLab CI: :latest job images, literal credentials.
• Kubernetes: :latest images, missing probes and resources, privileged pods, root users, privilege escalation, writable root FS, capabilities, host namespaces, hostPath, literal secrets, committed Secret data.
• Repo: .env not gitignored or already tracked by git, plus credential patterns (AWS, GitHub, Stripe, Slack, OpenAI/Anthropic keys, private keys, database URLs with passwords).

Suppress a rule where it genuinely doesn't apply, with a reason:

# vibe-ship: ignore VS-D022 Kubernetes probes cover health for this distroless image

Use it as a GitHub Action

jobs:
  deploy-config-audit:
    runs-on: ubuntu-latest
    permissions: { contents: read, security-events: write }
    steps:
      - uses: actions/checkout@v7
      - uses: sudais-khalid/vibe-ship@v2
        with:
          fail-on: high          # critical | high | medium | low | none

Findings appear in the repository's Security → Code scanning tab and in the job summary. Outputs: score, grade, sarif-file.

How it works

detect.py ──> stack templates ──> files ──> pin_actions.py ──> audit.py ──> docker build + run + health check
(evidence)    (references/)                 (SHA-pin CI)       (93 rules)    (when Docker is available)

1. Detect. It reads package.json, lockfiles, pyproject.toml, go.mod, Cargo.toml, pom.xml, *.csproj, Gemfile, composer.json, mix.exs and more. That gives it the framework, the runtime version you declared, port, entrypoint, health route, backing services from real dependency names, and the env vars your code reads.
2. Generate. It adapts verified per-stack templates from references/ to what was detected. It never overwrites existing deployment files without asking, and it never changes your app code without asking.
3. Harden. It pins every GitHub Action to a commit SHA and runs the auditor on its own output until there are no MEDIUM-or-worse findings.
4. Prove it. When Docker is available, it builds the images, starts the stack, waits for healthchecks, curls the health endpoint, checks the container isn't root, and cleans up.

Template verification results

The templates are extracted verbatim from references/, built, run, health-checked, and stopped. Docker 29.9, 2026-10-22:

Verification also caught three bugs a static review would miss, and all three are fixed:

• an empty node_modules COPY failing on zero-dependency apps
• Rust binaries ignoring SIGTERM as PID 1 (10 s stall, then SIGKILL)
• Postgres 18's moved PGDATA, now audit rule VS-C061

How vibe-ship compares