Agent skill · software engineering · jeremylongshore
bamboohr-deploy-integration
Deploy a BambooHR connector with tenant-isolated secrets, OAuth callback controls, durable token refresh, health probes, and staged rollback. Use when promoting an integration across environments. Trigger with "deploy BambooHR", "BambooHR production deployment", or "BambooHR environment promotion".
Why this skill is useful
Adds executable deployment scripts and configurations for BambooHR integrations across multiple cloud platforms that aren't available in public documentation.
What it needs
Requires fly, gcloud, vercel installed locally. Requires bamboohr account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
BambooHR Controlled Deployment Overview Promote an already-tested BambooHR connector without baking one cloud vendor's CLI into the skill. Separate application deployment, secret mutation, OAuth registration, webhook replacement, data migration, and traffic cutover because they have different approvals and rollback behavior. Prerequisites The target repository or integration path and the requested operator outcome. The tenant, identity, and data scope only when approved live work is in scope. The current evidence register plus customer-specific permissions and agreements. Current Contract The application must use the tenant-local BambooHR host. OAuth redirects are exact HTTPS locations and refreshed tokens require application persistence. Webhook destinations require HTTPS and creation yields a one-time verification key. Health checks must not expose employee data or require broad HR permissions. Authentication Create distinct identities/secrets per environment and tenant. Bind token records to subject and tenant. Deployment health may verify local configuration and dependencies; a live BambooHR readiness check must be separately approved, read-only, low sensitivity, body-discarding, and rate bounded. Instructions 1. Record immutable artifact digest, source commit, configuration schema, target environment, tenant set, deployment owner, data migration, and rollback owner. 2. Diff configuration names and secret references without reading secret values. Verify no production credential appears in build args, images, logs, or previews. 3. Validate exact OAuth redirect URIs, trusted tenant mapping, encrypted token persistence, rotation callback, egress policy, TLS, and log redaction. 4. Run offline tests, schema checks, migration dry run, and synthetic webhook verification before deploying the immutable artifact. 5. Deploy dark or to a canary. Run local liveness/readiness first; then, if approved, one body-discarding company-information check with a request ID. 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/bamboohr-deploy-integration