$npx -y skills add luongnv89/skills --skill devops-pipelineConfigure pre-commit hooks and lean GitHub Actions for shift-left quality assurance. Use when adding or auditing CI/CD to maximize local test coverage and minimize CI cost. Skip for Terraform/K8s, deployment pipelines, or non-GitHub CI providers.
| 1 | # DevOps Pipeline |
| 2 | |
| 3 | Implement comprehensive DevOps quality gates adapted to project type, with a **shift-left philosophy**: run as many checks as possible locally via pre-commit so developers get fast feedback and CI is a safety net rather than the primary gate. |
| 4 | |
| 5 | **Core principle**: If a check can run locally in under ~60 seconds, it belongs in pre-commit. GitHub Actions should handle things that can't run locally: matrix version testing, secrets-based security scans, deployment, and reporting. |
| 6 | |
| 7 | To stay within the agent's context budget, this SKILL keeps templates short and links to `references/*.md` for language-specific configs, workflow templates, and the CLI E2E script. |
| 8 | |
| 9 | ## Repo Sync Before Edits (mandatory) |
| 10 | Before creating/updating/deleting files in an existing repository, sync the current branch with remote: |
| 11 | |
| 12 | ```bash |
| 13 | branch="$(git rev-parse --abbrev-ref HEAD)" |
| 14 | git fetch origin |
| 15 | git pull --rebase origin "$branch" |
| 16 | ``` |
| 17 | |
| 18 | If the working tree is not clean, stash first, sync, then restore: |
| 19 | |
| 20 | ```bash |
| 21 | git stash push -u -m "pre-sync" |
| 22 | branch="$(git rev-parse --abbrev-ref HEAD)" |
| 23 | git fetch origin && git pull --rebase origin "$branch" |
| 24 | git stash pop |
| 25 | ``` |
| 26 | |
| 27 | If `origin` is missing, pull is unavailable, or rebase/stash conflicts occur, stop and ask the user before continuing. |
| 28 | |
| 29 | ## Workflow |
| 30 | |
| 31 | ### 1. Analyze Project |
| 32 | |
| 33 | Detect project characteristics: |
| 34 | |
| 35 | ```bash |
| 36 | # Check for package files and configs |
| 37 | ls -la package.json pyproject.toml Cargo.toml go.mod pom.xml build.gradle *.csproj 2>/dev/null |
| 38 | ls -la .eslintrc* .prettierrc* tsconfig.json mypy.ini setup.cfg ruff.toml 2>/dev/null |
| 39 | ls -la .pre-commit-config.yaml .github/workflows/*.yml 2>/dev/null |
| 40 | ``` |
| 41 | |
| 42 | Identify: |
| 43 | - **Languages**: JS/TS, Python, Go, Rust, Java, C#, etc. |
| 44 | - **Frameworks**: React, Next.js, Django, FastAPI, etc. |
| 45 | - **Build system**: npm, yarn, pnpm, pip, poetry, cargo, go, maven, gradle |
| 46 | - **Existing tooling**: Linters, formatters, type checkers already configured |
| 47 | - **Is this a CLI tool?** — if yes, enumerate all commands/subcommands (check README, `--help`, `click`/`argparse`/`cobra` source) to build an E2E test suite |
| 48 | |
| 49 | ### 2. Configure Pre-commit Hooks (maximize local coverage) |
| 50 | |
| 51 | Install pre-commit framework: |
| 52 | |
| 53 | ```bash |
| 54 | pip install pre-commit # or brew install pre-commit |
| 55 | ``` |
| 56 | |
| 57 | Create `.pre-commit-config.yaml` based on detected stack. See [references/precommit-configs.md](references/precommit-configs.md) for language-specific configurations. |
| 58 | |
| 59 | **What to put in pre-commit (run on every commit):** |
| 60 | - Format checks (Prettier, Black/Ruff, gofmt, rustfmt) |
| 61 | - Lint (ESLint, Ruff, golangci-lint, Clippy) |
| 62 | - Type checks (tsc, mypy) |
| 63 | - Security scans that work offline (Bandit, cargo-audit, gosec, `detect-secrets`) |
| 64 | - Unit tests (fast, <10s) — always on `commit` stage |
| 65 | - Build/compile verification (catches import errors, compile failures early) |
| 66 | |
| 67 | **What to put in pre-commit on `push` stage (run on git push):** |
| 68 | - Full test suite (unit + integration) |
| 69 | - **End-to-end tests for every CLI command** (see below) |
| 70 | - Coverage checks |
| 71 | - Slower linters (full golangci-lint ruleset) |
| 72 | |
| 73 | **What stays in GitHub Actions only:** |
| 74 | - Matrix version testing (multiple Node/Python/Go versions) |
| 75 | - Secrets-based scans (Snyk, SAST tools needing tokens) |
| 76 | - Deployment / release workflows |
| 77 | - Flaky or environment-sensitive tests that need a clean VM |
| 78 | |
| 79 | #### CLI End-to-End Testing |
| 80 | |
| 81 | If the project is a CLI tool, create `scripts/e2e_test.sh` that exercises every command/subcommand to verify the CLI works end-to-end (not just compiles). Wire it into pre-commit on the `push` stage. |
| 82 | |
| 83 | See [references/cli-e2e.md](references/cli-e2e.md) for command discovery patterns, the script template, and the pre-commit hook snippet. |
| 84 | |
| 85 | Install hooks: |
| 86 | |
| 87 | ```bash |
| 88 | pre-commit install |
| 89 | pre-commit install --hook-type pre-push # also install push-stage hooks |
| 90 | pre-commit run --all-files # Test on existing code |
| 91 | ``` |
| 92 | |
| 93 | ### 3. Create GitHub Actions Workflows (lean CI) |
| 94 | |
| 95 | Create `.github/workflows/ci.yml` — but keep it lean since pre-commit already catches most issues. See [references/github-actions.md](references/github-actions.md) for workflow templates. |
| 96 | |
| 97 | GitHub Actions responsibilities (things pre-commit can't do): |
| 98 | - Matrix testing across language versions (important for libraries) |
| 99 | - Upload coverage reports (Codecov, etc.) |
| 100 | - Deployment on merge to main |
| 101 | - PR status comments/badges |
| 102 | - Secrets-dependent scans |
| 103 | |
| 104 | Since pre-commit already runs lint, format, type-check, unit tests, and E2E tests — the CI workflow can be simpler: install deps → run pre-commit → run tests with coverage upload → build artifact. |
| 105 | |
| 106 | ```yaml |
| 107 | # Minimal CI when pre-commit covers everything locally: |
| 108 | - name: Run pre-commit |
| 109 | run: |