inno-safety-preflight

Run the safety preflight: it pushes to the default branch, which runs the platform's real safety gates without deploying anything. The Skill then narrates each gate's result and ends with a "Safe to ship" or "Not yet" verdict.

Eight jobs run: config-integrity, secrets (gitleaks), SAST (Semgrep), dependency audit, dep-age cooldown, container build and CVE scan, scaffold-check, and app-deps lockfile validation. All are prerequisites of the deploy job.

No. The Skill explicitly forbids local scanner runs because local results drift from CI's pinned tool versions and know nothing about centrally configured ignores or gate toggles. The push-triggered CI run is the authoritative preflight.

The dep-age gate fails when a pinned dependency was published more recently than the platform's cooldown (safety.min_release_age_days) allows, or when no committed package-lock.json exists. Wait out the cooldown, pin an older version, or commit the lockfile.

Never work around it in code. A platform admin can add a central ignore (safety.ignore.<tool>.<id>) for semgrep, trivy, or deps findings. Gitleaks findings use a committed .gitleaksignore file, and semgrep ignores all in-code suppression comments.

A guardrails violation is a hard stop regardless of CI results. The Skill names the specific policy line, explains the conflict, and blocks shipping until the app is changed or the user obtains an explicit admin exception.