Claude Skill

ci-cd

GitHub Actions, required checks, TestMu, OS matrix, and merge gates for Skill Doctor. Use when editing workflows, adding CI jobs, deciding what runs on every commit, or wiring crates/npm publish.

LLM Mart · 0 points · 9 16 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download kalarislabs-skill-doctor-skills_ci-cd-72aa35f.zip · 1 KB

kalarislabs/skill-doctor 13 1 forks Apache-2.0 Updated 7d ago

Part of kalarislabs/skill-doctor — 15 skills

Install

skills CLI npx skills add https://github.com/KalarisLabs/Skill-Doctor/tree/main/skills/ci-cd

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install kalarislabs-skill-doctor@llmmart

Git git clone https://github.com/KalarisLabs/Skill-Doctor.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole kalarislabs/skill-doctor collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

CI/CD

Canonical policy: TESTING.md. Workflows must match it. If you change a required check, update TESTING.md in the same PR.

Every commit / every PR (required, must stay fast)

Job names (branch protection should match these strings):

lint-and-unit — fmt, clippy -D warnings, cargo test --workspace --locked, invariant grep
os-cli (ubuntu-latest) / (macos-latest) / (windows-latest) — build CLI, --help, version, later: benign exit 0 and SD-02 exit 2
supply-chain — cargo deny, gitleaks

Keep this path under ~8 minutes on cache hit. Use Swatinem/rust-cache. OS matrix fail-fast: false.

Do not put on this path: TestMu Kane, competitor benches, musl cross, cargo publish, npm publish, coverage fail gates during bootstrap.

Not every commit

Workflow	Trigger	Why
`testmu.yml`	label `e2e`, nightly, `main`, `workflow_dispatch`	Kane/LambdaTest is slow, billed, AI-flaky
`bench.yml`	nightly + tags	Docker competitor pulls
`release.yml`	tags `v*` only	musl, SBOM, Sigstore, crates.io, npm

How an agent should add CI

New product behavior → add a unit/CLI test first. CI already runs cargo test.
New tooling (deny, gitleaks, a matrix OS) → add a job in ci.yml only if it belongs on every commit.
New expensive check → new workflow, non-required, document in TESTING.md.
Never store tokens in YAML. Use existing secrets: NPM_TOKEN, CARGO_REGISTRY_TOKEN, LT_USERNAME, LT_ACCESS_KEY.
Pin action versions; prefer SHA once v2 is tagged.
Do not add a fourth review bot. CodeRabbit / Greptile / Intelligence AI are PR comments, not required checks.

Local commands agents must run before claiming CI will pass

cargo fmt --all --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace --locked
./scripts/prepublish-check.sh --fast

--full is the pre-tag gate (deny + publish dry-run). Never cargo publish / npm publish from a feature branch.

Coverage

llvm-cov / tarpaulin is informational until a baseline exists. Do not -D fail PRs on coverage % during bootstrap.

Files (skill-doctor)

SKILL.md 2.4 KB

---
name: ci-cd
description: GitHub Actions, required checks, TestMu, OS matrix, and merge gates for Skill Doctor. Use when editing workflows, adding CI jobs, deciding what runs on every commit, or wiring crates/npm publish.
---

# CI/CD

Canonical policy: `TESTING.md`. Workflows must match it. If you change a required check, update `TESTING.md` in the same PR.

## Every commit / every PR (required, must stay fast)

Job names (branch protection should match these strings):

- `lint-and-unit` — fmt, clippy `-D warnings`, `cargo test --workspace --locked`, invariant grep
- `os-cli (ubuntu-latest)` / `(macos-latest)` / `(windows-latest)` — build CLI, `--help`, `version`, later: benign exit 0 and SD-02 exit 2
- `supply-chain` — `cargo deny`, gitleaks

Keep this path under ~8 minutes on cache hit. Use `Swatinem/rust-cache`. OS matrix `fail-fast: false`.

**Do not put on this path:** TestMu Kane, competitor benches, musl cross, `cargo publish`, `npm publish`, coverage fail gates during bootstrap.

## Not every commit

| Workflow | Trigger | Why |
|----------|---------|-----|
| `testmu.yml` | label `e2e`, nightly, `main`, `workflow_dispatch` | Kane/LambdaTest is slow, billed, AI-flaky |
| `bench.yml` | nightly + tags | Docker competitor pulls |
| `release.yml` | tags `v*` only | musl, SBOM, Sigstore, crates.io, npm |

## How an agent should add CI

1. New *product* behavior → add a unit/CLI test first. CI already runs `cargo test`.
2. New *tooling* (deny, gitleaks, a matrix OS) → add a job in `ci.yml` only if it belongs on every commit.
3. New *expensive* check → new workflow, non-required, document in `TESTING.md`.
4. Never store tokens in YAML. Use existing secrets: `NPM_TOKEN`, `CARGO_REGISTRY_TOKEN`, `LT_USERNAME`, `LT_ACCESS_KEY`.
5. Pin action versions; prefer SHA once v2 is tagged.
6. Do not add a fourth review bot. CodeRabbit / Greptile / Intelligence AI are PR comments, not required checks.

## Local commands agents must run before claiming CI will pass

```bash
cargo fmt --all --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace --locked
./scripts/prepublish-check.sh --fast
```

`--full` is the pre-tag gate (deny + publish dry-run). Never `cargo publish` / `npm publish` from a feature branch.

## Coverage

llvm-cov / tarpaulin is informational until a baseline exists. Do not `-D` fail PRs on coverage % during bootstrap.