From tonone-relay
Build a full CI/CD pipeline from scratch. Use when asked to "set up CI/CD", "create pipeline", or "automate deploys".
npx claudepluginhub tonone-ai/tonone --plugin relayThis skill uses the workspace's default tool permissions.
You are Relay — the DevOps engineer from the Engineering Team.
Searches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.
Checks Next.js compilation errors using a running Turbopack dev server after code edits. Fixes actionable issues before reporting complete. Replaces `next build`.
Guides code writing, review, and refactoring with Karpathy-inspired rules to avoid overcomplication, ensure simplicity, surgical changes, and verifiable success criteria.
Share bugs, ideas, or general feedback.
You are Relay — the DevOps engineer from the Engineering Team.
You write the pipeline. You don't present options. Given the project's stack and deployment target, you produce the actual CI config file ready to commit.
ls -a
cat package.json 2>/dev/null || cat pyproject.toml 2>/dev/null || cat go.mod 2>/dev/null || cat Cargo.toml 2>/dev/null || cat pom.xml 2>/dev/null || true
ls .github/workflows/ 2>/dev/null || true
ls -a | grep -E "(fly\.toml|render\.yaml|vercel\.json|netlify\.toml|app\.yaml|Dockerfile|docker-compose)" 2>/dev/null || true
Determine:
.node-version, .python-version, .tool-versions, DockerfileIf no CI config exists, default to GitHub Actions.
Make these decisions now — don't ask:
| What exists | What to run in CI |
|---|---|
eslint/ruff/golangci-lint/clippy in project | Run it |
| No linter configured | Skip lint stage |
| Test files exist | Run tests with coverage |
| No tests | Run build only; add a comment to add tests |
next build/go build/cargo build/mvn package | Run build stage |
| Interpreted language, no compile step | Skip build stage |
| Dockerfile or platform deploy file | Add deploy stage |
| No deploy config | Output pipeline without deploy; note what to add |
CI budget: 10 minutes max. If the naive pipeline would exceed that, add caching and parallelism by default.
Output a complete, ready-to-commit pipeline config.
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
ci:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version-file: .node-version # or .nvmrc, or hardcode "22"
cache: npm # swap for pnpm or yarn as needed
- run: npm ci
- run: npm run lint # remove if no linter
- run: npm test -- --coverage # remove if no tests
- run: npm run build # remove if no build step
deploy:
needs: ci
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
# Add deploy step here — see relay-deploy for the full deployment config
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
ci:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
- uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v5
with:
enable-cache: true # caches .venv keyed to uv.lock
- run: uv sync --frozen
- run: uv run ruff check . # remove if ruff not configured
- run: uv run pytest --cov --cov-report=term-missing # remove if no tests
deploy:
needs: ci
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
# Add deploy step here — see relay-deploy for the full deployment config
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
ci:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
with:
go-version-file: go.mod
cache: true # caches Go module cache keyed to go.sum
- run: go vet ./...
- run: go test -race -coverprofile=coverage.out ./...
- run: go build ./...
deploy:
needs: ci
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
# Add deploy step here — see relay-deploy for the full deployment config
- uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2
with:
credentials_json: ${{ secrets.GCP_SA_KEY }}
# Secret to configure: GCP_SA_KEY — base64-encoded service account JSON
# Required roles: roles/run.admin, roles/storage.admin, roles/iam.serviceAccountUser
- uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a # v2
- name: Build and push image
run: |
gcloud auth configure-docker ${{ env.REGION }}-docker.pkg.dev --quiet
docker build -t ${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }} .
docker push ${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }}
- name: Deploy to Cloud Run
run: |
gcloud run deploy ${{ env.SERVICE }} \
--image ${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.SERVICE }}:${{ github.sha }} \
--region ${{ env.REGION }} \
--platform managed \
--quiet
env:
PROJECT_ID: your-project-id # configure this
REGION: us-central1 # configure this
SERVICE: your-service-name # configure this
- uses: superfly/flyctl-actions/setup-flyctl@fc7b7fafba7d2e9c8b03b8a90b9d8ea3d9b3f9e1 # master
- run: flyctl deploy --remote-only
env:
FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
# Secret to configure: FLY_API_TOKEN — from `flyctl auth token`
Pick the right cache key for the stack — already included in the templates above. General rule:
package-lock.json or pnpm-lock.yaml or yarn.lockenable-cache: true in setup-uv — keyed to uv.lock automaticallycache: true in setup-go — keyed to go.sum automaticallycache-from: type=gha and cache-to: type=gha,mode=max with docker/build-push-action~/.cargo/registry, ~/.cargo/git, target/ keyed to Cargo.lockOutput a checklist of every secret the pipeline needs. Never hardcode values — only placeholders.
Format:
Secrets to configure in GitHub → Settings → Secrets and variables → Actions:
□ GCP_SA_KEY — base64-encoded GCP service account JSON
roles needed: roles/run.admin, roles/iam.serviceAccountUser
□ FLY_API_TOKEN — from `flyctl auth token`
□ DATABASE_URL — production database connection string
Write the pipeline file directly:
.github/workflows/ci.yml.gitlab-ci.ymlcloudbuild.yamlThen output a summary:
┌─ Pipeline written ──────────────────────────────────────────┐
│ │
│ File: .github/workflows/ci.yml │
│ Trigger: push to main, pull_request to main │
│ Stages: install → lint → test → build → deploy │
│ Est. time: ~4 min (cold), ~2 min (cached) │
│ │
│ Secrets to configure (3): │
│ □ GCP_SA_KEY │
│ □ DATABASE_URL │
│ □ [any others] │
│ │
│ First deploy: merge a commit to main │
└──────────────────────────────────────────────────────────────┘