# Verify Release Quality With Evidence

Teams need consistent release checks before code reaches production. This skill organizes static analysis, tests, integration validation, certification, and reports into one workflow.

## Install

```bash
npx skillstore add dnyoussef/when-verifying-quality-use-verification-quality
```

## Metadata

- Status: approved
- Slug: dnyoussef-when-verifying-quality-use-verification-quality
- Version: 1.0.0
- Author version: 1.0.0
- Skillstore revision: r1
- Version status: valid
- Tree hash: 41f8510934c597732f8ec6304c6d300f6d1dd67171ea8ae44028923bfac75d53
- Author: DNYoussef
- GitHub username: DNYoussef
- License: MIT
- Repository: https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/testing-quality/when-verifying-quality-use-verification-quality
- Ref: c579efd02184f1128d6741d16e6c8d951d7d4208
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, filesystem, scripts
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/dnyoussef-when-verifying-quality-use-verification-quality
- Manifest: https://skillstore.pages.dev/api/skills/dnyoussef-when-verifying-quality-use-verification-quality/manifest

## Capabilities

- Defines a five-phase workflow for static analysis, dynamic testing, integration validation, certification, and reporting.
- Provides example commands for SonarQube, ESLint, TypeScript, Jest, Cypress, Playwright, Pact, and Newman.
- Specifies measurable thresholds for maintainability, complexity, coverage, pass rates, and integration health.
- Lists expected report artifacts, audit trails, certification files, and stakeholder outputs.
- Coordinates the code-analyzer, tester, and production-validator roles through claude-flow hook examples.

## Use Cases

- Audit a Release Candidate: Run static checks, tests, integration validation, and certification before a release branch is approved.
- Build CI Quality Gates: Convert the workflow into CI stages that fail builds when quality scores or coverage targets are missed.
- Prepare Stakeholder Reports: Generate evidence-based summaries for quality, security, performance, and compliance review meetings.

## Prompt Templates

### Start a Quality Check

```
Use this skill to review my project quality. Start with static analysis and tell me which commands you need before running anything.
```

### Review Test Health

```
Use this skill to evaluate unit, integration, and end-to-end test results. Summarize failures, flaky tests, coverage gaps, and next actions.
```

### Validate Release Gates

```
Use this skill to check release gates for this branch. Compare the evidence against thresholds and identify blockers before approval.
```

### Design a CI Workflow

```
Use this skill to design a CI quality verification workflow for my repository. Include phases, required tools, artifacts, thresholds, and manual approval points.
```

## Limitations

- It does not include runnable implementation scripts; the target project must provide matching commands and configuration.
- Example metrics and approval text must be replaced with real evidence from the current build.
- Some checks require local services, third-party tools, or CI permissions that may not exist in every project.
- External commands and signing steps require user review before execution in sensitive repositories.

## Best Practices

- Run the workflow in a clean branch with project-specific tool configuration already committed.
- Replace every sample approval, score, and compliance claim with evidence from the current build.
- Review all external commands, package downloads, and signing operations before execution.

## Anti Patterns

- Do not treat sample certification text as real stakeholder approval.
- Do not run unreviewed project scripts or package downloads in a sensitive environment.
- Do not publish quality reports that omit failed tests, flaky tests, or known issues.

## Security Audit

- Audited at: 2026-07-05T12:01:23.122\+00:00
- Summary: Most static detections are false positives caused by Markdown fences, inline backticks, local report reads, and sample report text. Real risks remain around private-key signing, unpinned alpha package execution, and pre-filled approval language that could be used without evidence.

## Stats

- Views: 212
- Downloads: 7
- Favorites: 0
- Popularity score: 0