# Production engineering baseline

## CI gate

```bash
deno --version
deno ci
deno audit
deno fmt --check
deno lint
deno check **/*.ts
deno test
```

Pin Deno in CI, commit `deno.lock`, and never update dependencies as an automatic response to a failed build. Review dependency upgrades as separate changes.

## Runtime baseline

- Encode least privilege in a task or container `CMD`; add `--no-prompt` in production.
- Validate input, environment, and external responses at their boundaries.
- Give every external request a timeout, cancellation path, and bounded retry policy.
- Log request ID, status, duration, and error class, but not secrets or sensitive bodies.
- Separate liveness from readiness.
- Set memory, CPU, concurrency, and request-body limits around the process.

## Supply chain

Review maintenance, publisher, license, and lifecycle scripts for JSR/npm dependencies. Native addons and FFI bypass the JavaScript permission layer and require extra audit and OS isolation.

<Checklist id="deno-production-baseline" items={[
  "Pin Deno, commit deno.lock, and use deno ci",
  "Pass fmt, lint, check, and test",
  "Use least privilege and --no-prompt in production",
  "Keep secrets only in the platform secret store",
  "Verify timeout, cancellation, retry, and idempotency",
  "Verify health, logs, metrics, and rollback"
]} />

Official references: [Continuous integration](https://docs.deno.com/runtime/reference/continuous_integration/) and [Security](https://docs.deno.com/runtime/fundamentals/security/).