skills/devops-pipeline/SKILL.md
Implement pre-commit hooks and GitHub Actions for quality assurance. Use when asked to "setup CI/CD", "add pre-commit hooks", "create GitHub Actions", "setup quality gates", "automate testing", "add linting to CI", "setup code quality checks", "configure CI pipeline", "add automated checks", or any DevOps automation for code quality. Detects project type and configures appropriate tools. Trigger this skill whenever the user mentions CI, CD, pre-commit, GitHub Actions, linting automation, or quality gates — even if they don't use those exact terms.
npx skillsauth add montimage/skills devops-pipelineInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Implement comprehensive DevOps quality gates adapted to project type.
Before making any changes, sync with the remote to avoid conflicts:
branch="$(git rev-parse --abbrev-ref HEAD)"
git fetch origin
git pull --rebase origin "$branch"
If the working tree is dirty, stash first, sync, then pop. If origin is missing or conflicts occur, stop and ask the user before continuing.
Before making any changes:
feat/, feature/, etc.)feat/devops-pipelineDetect project characteristics.
Use sub-agents for parallel discovery. Launch multiple Agent tool calls concurrently to keep the main context clean:
package.json, pyproject.toml, Cargo.toml, go.mod, pom.xml, build.gradle, *.csproj and identify the primary language(s), frameworks (React, Next.js, Django, FastAPI, etc.), and build tools (npm, yarn, pnpm, pip, poetry, cargo, go, maven, gradle). Return a structured summary..eslintrc*, .prettierrc*, tsconfig.json, mypy.ini, setup.cfg, ruff.toml) and existing CI configs (.pre-commit-config.yaml, .github/workflows/*.yml). Return a checklist of what is present vs missing.Collect the results from all three agents before proceeding.
Use sub-agents for parallel file creation. The pre-commit config and GitHub Actions workflow are independent of each other. Dispatch them concurrently using the Agent tool, then collect results:
Agent A — Pre-commit hooks: Install the pre-commit framework (pip install pre-commit or brew install pre-commit). Create .pre-commit-config.yaml based on the detected stack from Step 1. Use references/precommit-configs.md for language-specific configurations. Install hooks with pre-commit install. Return the path of the created config file and a summary of hooks configured.
Agent B — GitHub Actions workflow: Create .github/workflows/ci.yml mirroring the pre-commit checks. Use references/github-actions.md for workflow templates. Follow these key principles:
Return the path of the created workflow file and a summary of jobs configured.
Each agent should return the path(s) of files it created or updated.
# Test pre-commit locally
pre-commit run --all-files
# Commit and push to trigger CI
git add .pre-commit-config.yaml .github/workflows/ci.yml
git commit -m "ci: add pre-commit hooks and GitHub Actions"
git push
Check GitHub Actions tab for workflow status.
| Language | Formatter | Linter | Security | Types | |----------|-----------|--------|----------|-------| | JS/TS | Prettier | ESLint | npm audit | TypeScript | | Python | Black/Ruff | Ruff | Bandit | mypy | | Go | gofmt | golangci-lint | gosec | built-in | | Rust | rustfmt | Clippy | cargo-audit | built-in | | Java | google-java-format | Checkstyle | SpotBugs | - |
development
Expand unit test coverage by targeting untested branches and edge cases. Use when users ask to "increase test coverage", "add more tests", "expand unit tests", "cover edge cases", "improve test coverage", "find untested code", "what's not tested", "run coverage report", "write missing tests", or want to identify and fill gaps in existing test suites. Adapts to project's testing framework. Trigger this skill whenever the user mentions test gaps, untested code, coverage percentages, or wants to harden their test suite.
development
Audit npm/pip/Docker/GitHub Actions for supply chain risks; apply cooldown, lockfile, ignore-scripts, SHA pinning, scanning after approval. Use for 'supply chain audit', 'harden dependencies'. Skip for runtime vulns, secret scanning, code review.
development
Analyze agent skills for security risks, malicious patterns, and potential dangers before installation. Use when asked to "audit a skill", "check if a skill is safe", "analyze skill security", "review skill risk", "should I install this skill", "is this skill safe", "scan this skill", or when evaluating any skill directory for trust and safety. Also triggers when the user pastes a skill install command like "npx skills add https://github.com/org/repo --skill name". Produces a comprehensive security report with a clear install/reject verdict. Trigger this skill proactively whenever the user is about to install a third-party skill or mentions concerns about skill safety.
development
Add OSS-standard files (README, CONTRIBUTING, LICENSE, CODE_OF_CONDUCT, SECURITY, GitHub templates) and run an 8-section readiness audit. Use for 'make this open source', 'OSS readiness', 'public release'. Skip for marketing pages or closed code.