scaffold-node-tool-quality-gates

Set Up Quality Gates for Node Tools

Use this skill when the user wants to design or set up hard quality gates for Node.js command-line tools, local daemons, MCP services, tool packages published to npm, or lightweight JavaScript/TypeScript tool repositories. The scope does not include browser experience gates for web frontend frameworks; for web frontends use scaffold-typescript-frontend-quality-gates。

Required Reading

Before proposing changes, read these files in full:

../references/three-layer-model.md
../references/landing-safety.md
../references/github-review-and-rulesets.md
../references/invocation-examples.md
../references/gate-levels-and-template.md
references/platform-quality-gates.md
references/concrete-rules.md

These paths are all anchored to the directory where this skill's SKILL.md is located; after loading the skill, progressively read the corresponding materials by relative path.

Process

Inspect the target repository's AGENTS.md、package.json, lockfile, Node version constraints, command-line entry points, test configuration, lint or type configuration, GitHub workflows, hook scripts, and existing gate orchestration entry points.
Form a plan according to the three-layer structure below.
If you need to extend rules or confirm the latest rule names, first check references/concrete-rules.md 's official documentation entry point; do not add rules from memory alone.
Use ../references/gate-levels-and-template.md 's tier table to give recommended tiers and trade-offs; do not decide the tier for the user.
Stop at the confirmation-before-write gate. Show the exact files and remote settings the plan will create or modify, then request explicit user approval.
After approval, land the narrowest useful scaffolding, run the new local entry point, and report GitHub settings that still require manual handling.

Layer One: Check Tools

Identify executable Node tool checks: syntax checks in package management scripts, native tests, lint, type checking, command-line smoke tests, package publishing shape checks, configuration drift tests, and project-specific tests that protect runtime boundaries.

Layer Two: Check Rules

Map each tool to the rules it enforces: script entry point stability, Node version compatibility, command-line argument behavior, asynchronous resource release, no leakage of sensitive environment variables, package contents and bin mapping correctness, dependency locking, configuration drift, and network boundaries.

Layer Three: Invocation Timing

Decide where checks run: local hooks provide fast feedback, pull request workflows serve as the authority, required status checks block merging, post-merge verification validates package shape or release smoke tests, and scheduled workflows cover dependency audits and external integration smoke tests.

Output Shape

Return a concise scaffolding plan containing:

Files planned to be created or modified;
Layer one tool table;
Layer two rule table;
Layer three invocation timing table;
confirmation-before-write prompt;
Post-implementation verification commands.