Production engineering baseline
Constrain Deno services with pinned versions, lockfiles, least privilege, CI, and observability
CI gate
deno --version
deno ci
deno audit
deno fmt --check
deno lint
deno check **/*.ts
deno test
Pin Deno in CI, commit deno.lock, and never update dependencies as an automatic response to a failed build. Review dependency upgrades as separate changes.
Runtime baseline
- Encode least privilege in a task or container
CMD; add--no-promptin production. - Validate input, environment, and external responses at their boundaries.
- Give every external request a timeout, cancellation path, and bounded retry policy.
- Log request ID, status, duration, and error class, but not secrets or sensitive bodies.
- Separate liveness from readiness.
- Set memory, CPU, concurrency, and request-body limits around the process.
Supply chain
Review maintenance, publisher, license, and lifecycle scripts for JSR/npm dependencies. Native addons and FFI bypass the JavaScript permission layer and require extra audit and OS isolation.
- Pin Deno, commit deno.lock, and use deno ci
- Pass fmt, lint, check, and test
- Use least privilege and --no-prompt in production
- Keep secrets only in the platform secret store
- Verify timeout, cancellation, retry, and idempotency
- Verify health, logs, metrics, and rollback
Official references: Continuous integration and Security.