Agent skill · software engineering · jeremylongshore
clickup-deploy-integration
Deploy and roll back a server-side ClickUp API and webhook service with secret injection, workspace guards, health probes, and durable queues. Use when releasing a ClickUp integration. Trigger with "deploy ClickUp", "ClickUp production release", or "ClickUp webhook service".
Why this skill is useful
Adds deployment scripts and health check implementations for ClickUp API integrations on multiple platforms, which are not commonly found in public documentation.
What it needs
Requires fly, gcloud, vercel installed locally. Requires clickup account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Deploy a ClickUp Integration Overview Release the integration as a reversible server-side boundary that keeps credentials out of clients and acknowledges webhooks quickly. Prerequisites A tested server-side adapter, environment inventory, and rollback artifact Environment-scoped secret references and authorized Workspace allow-lists HTTPS webhook ingress, raw-body signature verification, durable queueing, and observability Tool Discipline Use Read, Glob, and Grep to inspect the repository, adapters, configuration names, tests, and evidence. Use WebFetch only for current official ClickUp documentation. Use Write or Edit after confirming the target file, Workspace boundary, and requested mode. Current Contract ClickUp tokens belong on the server; browser CORS errors are not solved by exposing a token. Webhook verification uses the raw request body, the webhook secret, HMAC-SHA256, and X-Signature. Webhook handlers should acknowledge within ClickUp's seven-second health boundary and process asynchronously. v2 and v3 base paths remain explicit per operation. Authentication Use a personal token only for accountable individual/testing work or OAuth Authorization Code for a user-facing integration. Inject the token server-side through a governed secret reference, send it in Authorization, verify authorized Workspace IDs, and never print the token, OAuth client secret, or webhook secret. Instructions 1. Inventory deploy target, endpoint/version matrix, callback URLs, secret references, and Workspace allow-lists. 2. Build and test offline contracts, raw-body signature handling, queue idempotency, and redaction. 3. Deploy dark with outbound writes disabled and webhook registration unchanged. 4. Run bounded identity, Workspace, health, and synthetic signed-event probes. 5. Canary trusted traffic, watch rate/error/webhook-health metrics, and verify durable side effects. 6. Promote or roll back; then reconcile secrets, callbacks, queues, and deployment evidence. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/clickup-deploy-integration