[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71HQE7V97NCACS0BACDMQQD":3,"skill-same:01M71HQE7V97NCACS0BACDMQQD":64},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":46,"ownerHtmlUrl":47,"ownerBlogUrl":48,"ownerDescription":6,"updatedAt":49,"install":50,"resources":63},"01M71HQE7V97NCACS0BACDMQQD","wire-ci",null,"CI pipeline setup with bundled, forge-neutral templates and local validation. Detects the forge from the git remote, generates workflows for supported forges, and skips honestly for the rest. The CI equivalent of wire-observability.","danielvm-git\u002Fbigpowers","danielvm-git","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1020864?v=4","01M71H1N1CTQ529S0KN7KETVG6","Daniel V M","01M71H1N218Y3S8WHCJ58NPRSW",292,"MIT","https:\u002F\u002Fgithub.com\u002Fdanielvm-git\u002Fbigpowers\u002Fblob\u002Fmain\u002F.codex\u002Fskills\u002Fwire-ci\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35],"wire ci","ci","setup","templates","validation","REST","with","ci pipeline setup","for","observability","sonnet","git","workflows","forge","remote","local","pipeline","2026-11-10 10:12:30",false,"---\nname: wire-ci\nmodel: sonnet\ndescription: \"CI pipeline setup with bundled, forge-neutral templates and local validation. Detects the forge from the git remote, generates workflows for supported forges, and skips honestly for the rest. The CI equivalent of wire-observability.\"\n---\n\n# Wire CI\n\n> **HARD GATE (supported forges only)** — Do not ship a project without CI. Run this skill before first merge to main.\n>\n> On a forge bigpowers ships no templates for, this skill **is not a gate**: it reports the forge, explains what it cannot do, and exits 3. A gate that cannot run must not claim it did. See § Unsupported forges.\n>\n> **HARD GATE** — CI that is untestable locally will break every cycle. Always run `--validate` after generating workflows and `--dry-run` before pushing.\n\nGenerate, validate, and test CI workflows. Detects the forge and project type, copies a **bundled** template, and verifies locally before anything reaches CI.\n\n## Forge resolution\n\n`scripts\u002Flib\u002Fdetect-forge.sh` resolves the forge, first match wins: `BIGPOWERS_FORGE` env var → `forge:` in `specs\u002Fforge.yaml` → the `origin` remote URL → `unknown`.\n\n```bash\nbash scripts\u002Fwire-ci.sh --detect     # report forge + stack, write nothing\nbash scripts\u002Fwire-ci.sh --plan       # show the template that would be used\nbash scripts\u002Fwire-ci.sh --apply      # write the workflow\n```\n\nGitHub ships templates (`.github\u002Fworkflows\u002F`). GitLab, Bitbucket, Codeberg, and Gitea are detected but **unsupported** — `--apply` writes nothing and exits 3.\n\n## Template source — configurable, bundled by default\n\nTemplates live in `docs\u002Ftemplates\u002Fci\u002F\u003Cforge>\u002F` **inside the bigpowers package**, so there is no network dependency on any third party's repository. Override with `BIGPOWERS_CI_TEMPLATES=\u002Fpath\u002Fto\u002Fyour\u002Ftemplates`, laid out as `\u003Croot>\u002F\u003Cforge>\u002Ftest-build-release-\u003Cstack>.yml`.\n\n## What this sets up\n\n1. **Test Build Release workflow** — lint → test → build → release in one `needs:` chain\n2. **`--validate` mode** — YAML syntax, workflow permissions, required secrets, common pitfalls\n3. **`--dry-run` mode** — runs workflows locally via `act` before push\n4. **Failure pattern documentation** — see the table below\n\nDeploy workflows are **not** bundled: they are platform-specific. See [REFERENCE.md](REFERENCE.md) for a worked example.\n\n## Process\n\n### 1. Detect forge and stack\n\n```bash\nbash scripts\u002Fwire-ci.sh --detect\n```\n\nStack detection reads the project root:\n\n| Manifest | Stack | Bundled template |\n|----------|-------|------------------|\n| `Cargo.toml` | Rust | `test-build-release-rust.yml` |\n| `package.json` | Node | `test-build-release-node.yml` |\n| `pyproject.toml` \u002F `setup.py` | Python | `test-build-release-python.yml` |\n| `go.mod` | Go | `test-build-release-go.yml` |\n\nNo recognized manifest → exit 3 with the list of manifests it looked for. Do not guess.\n\n### 2. Apply the template\n\n```bash\nbash scripts\u002Fwire-ci.sh --apply\n```\n\n**Do not rename the workflow `name:` field** — deploy listens for `\"Test Build Release\"`.\n\nEdit placeholders after copying: language versions, `APP_TYPE`, `SITE_URL`.\n\n### 3. Unsupported forges\n\n`--apply` writes nothing and exits 3. Your options, in the order the runner prints them:\n\n- point `BIGPOWERS_CI_TEMPLATES` at templates for your forge\n- pin `forge: github` in `specs\u002Fforge.yaml` if the remote is misdetected\n- write the CI config by hand\n\nContributing a `docs\u002Ftemplates\u002Fci\u002Fgitlab\u002F` set and adding `gitlab` to `FORGE_SUPPORTED_LIST` is the natural next slice — per-forge command mapping (`gh pr checks` → `glab ci status`) is not implemented yet.\n\n### 4. Validate workflows (`--validate`)\n\nSee [REFERENCE.md](REFERENCE.md). Exit codes: `0` clean, `1` YAML syntax errors, `2` warnings only.\n\n### 5. Dry-run workflows (`--dry-run`)\n\nSee [REFERENCE.md](REFERENCE.md).\n\n> **act** runs workflows in a local Docker environment — the most accurate pre-push validation.\n> **gh workflow run** sends the workflow to GitHub but does not execute locally.\n\n### 6. Document common CI failure patterns\n\n| Failure | Cause | Fix |\n|---------|-------|-----|\n| `npm publish` fails | `NPM_TOKEN` not set as repo secret | Add `NPM_TOKEN` to repo secrets |\n| `semantic-release` fails on push | Missing `permissions: contents: write` | Add it to the release job |\n| `cargo publish` auth fail | `CARGO_REGISTRY_TOKEN` not set | Add token to env or `~\u002F.cargo\u002Fconfig.toml` |\n| `go vet` fails | Go version mismatch | Use `go-version-file: go.mod` |\n| `cargo clippy` errors | New nightly lints | Pin the toolchain; `cargo clippy --fix` |\n| `act` not found | Docker not running or act missing | `brew install act`; `docker ps` |\n| Hardcoded Node version stale | `.nvmrc` exists but workflow hardcodes | Use `node-version-file: .nvmrc` |\n| Deploy never runs | TBR workflow renamed | Keep `name: Test Build Release` |\n| Release rebuilds binary | Artifact not downloaded | `release` must `download-artifact` from `build` |\n\n## Verify\n\n→ verify: `bash scripts\u002Fwire-ci.sh --self-test`\n→ verify: `test -f docs\u002Ftemplates\u002Fci\u002Fgithub\u002Ftest-build-release-node.yml && test -f scripts\u002Flib\u002Fdetect-forge.sh`\n→ verify: `grep -q wire-ci SKILL-INDEX.md`\n\n---\n\n# Wire Ci — Reference\n\n## Navigation\n\n| Lines | Section |\n|-------|---------|\n| 1 | Title |\n| 3–20 | Navigation |\n| 21–22 | Examples |\n| 23–39 | Create CI for a Go project (TBR + optional deploy) |\n| 40–49 | Create CI for a CLI tool (TBR only, no deploy) |\n| 50–57 | Validate existing workflows (no generation) |\n| 58–70 | Options |\n| 71–79 | Integration with build-epic |\n| 80–154 | Reference block 1 — test-build-release.yml (Go, excerpt) |\n| 155–204 | Reference block 2 — deploy.yml (generic web app, excerpt) |\n| 205–232 | Reference block 3 — CLI dogfood (big-release pattern) |\n| 233–257 | Reference block 4 — validate script |\n| 258–268 | Reference block 5 — dry-run |\n\n## Examples\n\n### Create CI for a Go project (TBR + optional deploy)\n\n```bash\n# Resolve forge + stack, then apply the bundled template\nbash scripts\u002Fwire-ci.sh --detect\nbash scripts\u002Fwire-ci.sh --apply\n\nwire-ci --validate\nwire-ci --dry-run\n```\n\nTo use your own org templates instead of the bundled ones:\n\n```bash\nBIGPOWERS_CI_TEMPLATES=\u002Fpath\u002Fto\u002Fyour\u002Ftemplates bash scripts\u002Fwire-ci.sh --apply\n```\n\n### Create CI for a CLI tool (TBR only, no deploy)\n\n```bash\nbash scripts\u002Fwire-ci.sh --apply\n# Edit release job to download build artifact — see big-release dogfood\n# CLI\u002Flibrary repos: delete deploy.yml; the release job is terminal.\n\nwire-ci --validate\n```\n\n### Validate existing workflows (no generation)\n\n```bash\nwire-ci --validate --check-only\n```\n\n---\n\n## Options\n\n| Flag | Description |\n|------|-------------|\n| `--validate` | Check YAML syntax, permissions, secrets, common pitfalls |\n| `--dry-run` | Run workflows locally via `act` or dispatch via `gh` |\n| `--check-only` | Only validate, do not generate new files |\n| `--type \u003Ctype>` | Force project type (skip auto-detection) |\n| `--force` | Overwrite existing workflow files |\n| `--no-deploy` | Skip deploy.yml even for hosted stacks |\n\n---\n\n## Integration with build-epic\n\nWhen `wire-ci` is used as part of `build-epic`:\n\n1. **During develop-tdd**: If the task modifies `.github\u002Fworkflows\u002F`, run `wire-ci --validate` as a CI dry-run sub-step\n2. **During release-branch**: After push, run `gh run list --limit 1 --branch main --json status,conclusion` to verify CI passes\n\n---\n\n## Reference block 1 — test-build-release.yml (Go, excerpt)\n\n```yaml\nname: Test Build Release\non:\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n\npermissions:\n  contents: read\n\nconcurrency:\n  group: pipeline-${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  lint:\n    runs-on: ubuntu-22.04\n    timeout-minutes: 10\n    steps:\n      - uses: actions\u002Fcheckout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0\n      - uses: actions\u002Fsetup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0\n        with:\n          go-version: '1.22'\n          cache: true\n      - uses: golangci\u002Fgolangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84  # v6.5.2\n        with:\n          version: v1.64.8\n\n  test:\n    needs: [lint]\n    runs-on: ubuntu-22.04\n    steps:\n      - uses: actions\u002Fcheckout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0\n      - uses: actions\u002Fsetup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0\n        with:\n          go-version: '1.22'\n          cache: true\n      - run: go vet .\u002F...\n      - run: go test .\u002F... -count=1\n\n  build:\n    needs: [test]\n    runs-on: ubuntu-22.04\n    steps:\n      - uses: actions\u002Fcheckout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0\n      - uses: actions\u002Fsetup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0\n        with:\n          go-version: '1.22'\n          cache: true\n      - run: go build .\u002F...\n      - run: jq -n --arg sha \"${{ github.sha }}\" '{sha: $sha}' > deploy-meta.json\n      - uses: actions\u002Fupload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1\n        with:\n          name: deploy-meta\n          path: deploy-meta.json\n\n  release:\n    if: github.ref == 'refs\u002Fheads\u002Fmain' && github.event_name == 'push'\n    needs: [build]\n    permissions:\n      contents: write\n    steps:\n      - uses: actions\u002Fcheckout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0\n        with:\n          fetch-depth: 0\n      - run: npx semantic-release\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n```\n\n---\n\n## Reference block 2 — deploy.yml (generic web app, excerpt)\n\n```yaml\nname: Deploy\non:\n  workflow_run:\n    workflows: [\"Test Build Release\"]\n    types: [completed]\n\npermissions:\n  contents: read\n  actions: read\n\nconcurrency:\n  group: deploy-production\n  cancel-in-progress: false\n\nenv:\n  SITE_URL: \"https:\u002F\u002FCHANGE-ME.example.com\"\n\njobs:\n  deploy:\n    if: >\n      github.event.workflow_run.conclusion == 'success' &&\n      github.event.workflow_run.head_branch == 'main'\n    runs-on: ubuntu-22.04\n    environment: production\n    steps:\n      - uses: actions\u002Fdownload-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1\n        with:\n          name: deploy-meta\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n          run-id: ${{ github.event.workflow_run.id }}\n          path: deploy-meta\n      # Placeholder deploy step — bigpowers ships no deploy templates and pins\n      # no third-party action. Substitute your platform's own step here, or drop\n      # the deploy job entirely for CLI and library repos. Pin whatever action\n      # you choose to a full commit SHA rather than a tag. (GH #104)\n      - name: Deploy\n        run: |\n          echo \"Replace this step with your platform's deploy command.\"\n          echo \"commit=$(jq -r .sha deploy-meta\u002Fdeploy-meta.json)\"\n          exit 1\n      - name: Health check\n        run: |\n          curl -sf \"${{ env.SITE_URL }}\" || exit 1\n```\n\n---\n\n## Reference block 3 — CLI dogfood (big-release pattern)\n\n```yaml\n  build:\n    needs: [test]\n    steps:\n      - run: make build\n      - uses: actions\u002Fupload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1\n        with:\n          name: big-release-${{ github.sha }}\n          path: bin\u002Fbig-release\n\n  release:\n    needs: [build]\n    if: github.ref == 'refs\u002Fheads\u002Fmain' && github.event_name == 'push'\n    steps:\n      - uses: actions\u002Fdownload-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1\n        with:\n          name: big-release-${{ github.sha }}\n          path: bin\n      - run: make release   # cross-compile assets only; host binary from artifact\n      - run: big-release release --verbose\n```\n\nNo `deploy.yml` — CLI publishes via the release job.\n\n---\n\n## Reference block 4 — validate script\n\n```bash\nfor f in .github\u002Fworkflows\u002F*.yml .github\u002Fworkflows\u002F*.yaml; do\n  [ -f \"$f\" ] || continue\n  python3 -c \"import yaml; yaml.safe_load(open('$f'))\" || echo \"FAIL: $f has YAML syntax errors\"\ndone\n\nfor f in .github\u002Fworkflows\u002Ftest-build-release.yml; do\n  if grep -q \"permissions:\" \"$f\"; then\n    echo \"OK: $f has permissions block\"\n  else\n    echo \"WARNING: $f missing permissions block\"\n  fi\ndone\n\nif grep -q 'workflows: \\[\"Test Build Release\"\\]' .github\u002Fworkflows\u002Fdeploy.yml 2>\u002Fdev\u002Fnull; then\n  if ! grep -q 'name: Test Build Release' .github\u002Fworkflows\u002Ftest-build-release.yml; then\n    echo \"WARNING: deploy.yml listens for Test Build Release but TBR name may differ\"\n  fi\nfi\n```\n\n---\n\n## Reference block 5 — dry-run\n\n```bash\nif command -v act &>\u002Fdev\u002Fnull; then\n  act push --dry-run -W .github\u002Fworkflows\u002Ftest-build-release.yml\nelif command -v gh &>\u002Fdev\u002Fnull; then\n  gh workflow run test-build-release.yml --ref \"$(git branch --show-current)\"\nelse\n  echo \"Install act or gh for dry-run\"\nfi\n```\n","# Wire CI\n\n> **HARD GATE (supported forges only)** — Do not ship a project without CI. Run this skill before first merge to main.\n>\n> On a forge bigpowers ships no templates for, this skill **is not a gate**: it reports the forge, explains what it cannot do, and exits 3. A gate that cannot run must not claim it did. See § Unsupported forges.\n>\n> **HARD GATE** — CI that is untestable locally will break every cycle. Always run `--validate` after generating workflows and `--dry-run` before pushing.\n\nGenerate, validate, and test CI workflows. Detects the forge and project type, copies a **bundled** template, and verifies locally before anything reaches CI.\n\n## Forge resolution\n\n`scripts\u002Flib\u002Fdetect-forge.sh` resolves the forge, first match wins: `BIGPOWERS_FORGE` env var → `forge:` in `specs\u002Fforge.yaml` → the `origin` remote URL → `unknown`.\n\n```bash\nbash scripts\u002Fwire-ci.sh --detect     # report forge + stack, write nothing\nbash scripts\u002Fwire-ci.sh --plan       # show the template that would be used\nbash scripts\u002Fwire-ci.sh --apply      # write the workflow\n```\n\nGitHub ships templates (`.github\u002Fworkflows\u002F`). GitLab, Bitbucket, Codeberg, and Gitea are detected but **unsupported** — `--apply` writes nothing and exits 3.\n\n## Template source — configurable, bundled by default\n\nTemplates live in `docs\u002Ftemplates\u002Fci\u002F\u003Cforge>\u002F` **inside the bigpowers package**, so there is no network dependency on any third party's repository. Override with `BIGPOWERS_CI_TEMPLATES=\u002Fpath\u002Fto\u002Fyour\u002Ftemplates`, laid out as `\u003Croot>\u002F\u003Cforge>\u002Ftest-build-release-\u003Cstack>.yml`.\n\n## What this sets up\n\n1. **Test Build Release workflow** — lint → test → build → release in one `needs:` chain\n2. **`--validate` mode** — YAML syntax, workflow permissions, required secrets, common pitfalls\n3. **`--dry-run` mode** — runs workflows locally via `act` before push\n4. **Failure pattern documentation** — see the table below\n\nDeploy workflows are **not** bundled: they are platform-specific. See [REFERENCE.md](REFERENCE.md) for a worked example.\n\n## Process\n\n### 1. Detect forge and stack\n\n```bash\nbash scripts\u002Fwire-ci.sh --detect\n```\n\nStack detection reads the project root:\n\n| Manifest | Stack | Bundled template |\n|----------|-------|------------------|\n| `Cargo.toml` | Rust | `test-build-release-rust.yml` |\n| `package.json` | Node | `test-build-release-node.yml` |\n| `pyproject.toml` \u002F `setup.py` | Python | `test-build-release-python.yml` |\n| `go.mod` | Go | `test-build-release-go.yml` |\n\nNo recognized manifest → exit 3 with the list of manifests it looked for. Do not guess.\n\n### 2. Apply the template\n\n```bash\nbash scripts\u002Fwire-ci.sh --apply\n```\n\n**Do not rename the workflow `name:` field** — deploy listens for `\"Test Build Release\"`.\n\nEdit placeholders after copying: language versions, `APP_TYPE`, `SITE_URL`.\n\n### 3. Unsupported forges\n\n`--apply` writes nothing and exits 3. Your options, in the order the runner prints them:\n\n- point `BIGPOWERS_CI_TEMPLATES` at templates for your forge\n- pin `forge: github` in `specs\u002Fforge.yaml` if the remote is misdetected\n- write the CI config by hand\n\nContributing a `docs\u002Ftemplates\u002Fci\u002Fgitlab\u002F` set and adding `gitlab` to `FORGE_SUPPORTED_LIST` is the natural next slice — per-forge command mapping (`gh pr checks` → `glab ci status`) is not implemented yet.\n\n### 4. Validate workflows (`--validate`)\n\nSee [REFERENCE.md](REFERENCE.md). Exit codes: `0` clean, `1` YAML syntax errors, `2` warnings only.\n\n### 5. Dry-run workflows (`--dry-run`)\n\nSee [REFERENCE.md](REFERENCE.md).\n\n> **act** runs workflows in a local Docker environment — the most accurate pre-push validation.\n> **gh workflow run** sends the workflow to GitHub but does not execute locally.\n\n### 6. Document common CI failure patterns\n\n| Failure | Cause | Fix |\n|---------|-------|-----|\n| `npm publish` fails | `NPM_TOKEN` not set as repo secret | Add `NPM_TOKEN` to repo secrets |\n| `semantic-release` fails on push | Missing `permissions: contents: write` | Add it to the release job |\n| `cargo publish` auth fail | `CARGO_REGISTRY_TOKEN` not set | Add token to env or `~\u002F.cargo\u002Fconfig.toml` |\n| `go vet` fails | Go version mismatch | Use `go-version-file: go.mod` |\n| `cargo clippy` errors | New nightly lints | Pin the toolchain; `cargo clippy --fix` |\n| `act` not found | Docker not running or act missing | `brew install act`; `docker ps` |\n| Hardcoded Node version stale | `.nvmrc` exists but workflow hardcodes | Use `node-version-file: .nvmrc` |\n| Deploy never runs | TBR workflow renamed | Keep `name: Test Build Release` |\n| Release rebuilds binary | Artifact not downloaded | `release` must `download-artifact` from `build` |\n\n## Verify\n\n→ verify: `bash scripts\u002Fwire-ci.sh --self-test`\n→ verify: `test -f docs\u002Ftemplates\u002Fci\u002Fgithub\u002Ftest-build-release-node.yml && test -f scripts\u002Flib\u002Fdetect-forge.sh`\n→ verify: `grep -q wire-ci SKILL-INDEX.md`\n\n---\n\n# Wire Ci — Reference\n\n## Navigation\n\n| Lines | Section |\n|-------|---------|\n| 1 | Title |\n| 3–20 | Navigation |\n| 21–22 | Examples |\n| 23–39 | Create CI for a Go project (TBR + optional deploy) |\n| 40–49 | Create CI for a CLI tool (TBR only, no deploy) |\n| 50–57 | Validate existing workflows (no generation) |\n| 58–70 | Options |\n| 71–79 | Integration with build-epic |\n| 80–154 | Reference block 1 — test-build-release.yml (Go, excerpt) |\n| 155–204 | Reference block 2 — deploy.yml (generic web app, excerpt) |\n| 205–232 | Reference block 3 — CLI dogfood (big-release pattern) |\n| 233–257 | Reference block 4 — validate script |\n| 258–268 | Reference block 5 — dry-run |\n\n## Examples\n\n### Create CI for a Go project (TBR + optional deploy)\n\n```bash\n# Resolve forge + stack, then apply the bundled template\nbash scripts\u002Fwire-ci.sh --detect\nbash scripts\u002Fwire-ci.sh --apply\n\nwire-ci --validate\nwire-ci --dry-run\n```\n\nTo use your own org templates instead of the bundled ones:\n\n```bash\nBIGPOWERS_CI_TEMPLATES=\u002Fpath\u002Fto\u002Fyour\u002Ftemplates bash scripts\u002Fwire-ci.sh --apply\n```\n\n### Create CI for a CLI tool (TBR only, no deploy)\n\n```bash\nbash scripts\u002Fwire-ci.sh --apply\n# Edit release job to download build artifact — see big-release dogfood\n# CLI\u002Flibrary repos: delete deploy.yml; the release job is terminal.\n\nwire-ci --validate\n```\n\n### Validate existing workflows (no generation)\n\n```bash\nwire-ci --validate --check-only\n```\n\n---\n\n## Options\n\n| Flag | Description |\n|------|-------------|\n| `--validate` | Check YAML syntax, permissions, secrets, common pitfalls |\n| `--dry-run` | Run workflows locally via `act` or dispatch via `gh` |\n| `--check-only` | Only validate, do not generate new files |\n| `--type \u003Ctype>` | Force project type (skip auto-detection) |\n| `--force` | Overwrite existing workflow files |\n| `--no-deploy` | Skip deploy.yml even for hosted stacks |\n\n---\n\n## Integration with build-epic\n\nWhen `wire-ci` is used as part of `build-epic`:\n\n1. **During develop-tdd**: If the task modifies `.github\u002Fworkflows\u002F`, run `wire-ci --validate` as a CI dry-run sub-step\n2. **During release-branch**: After push, run `gh run list --limit 1 --branch main --json status,conclusion` to verify CI passes\n\n---\n\n## Reference block 1 — test-build-release.yml (Go, excerpt)\n\n```yaml\nname: Test Build Release\non:\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n\npermissions:\n  contents: read\n\nconcurrency:\n  group: pipeline-${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  lint:\n    runs-on: ubuntu-22.04\n    timeout-minutes: 10\n    steps:\n      - uses: actions\u002Fcheckout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0\n      - uses: actions\u002Fsetup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0\n        with:\n          go-version: '1.22'\n          cache: true\n      - uses: golangci\u002Fgolangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84  # v6.5.2\n        with:\n          version: v1.64.8\n\n  test:\n    needs: [lint]\n    runs-on: ubuntu-22.04\n    steps:\n      - uses: actions\u002Fcheckout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0\n      - uses: actions\u002Fsetup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0\n        with:\n          go-version: '1.22'\n          cache: true\n      - run: go vet .\u002F...\n      - run: go test .\u002F... -count=1\n\n  build:\n    needs: [test]\n    runs-on: ubuntu-22.04\n    steps:\n      - uses: actions\u002Fcheckout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0\n      - uses: actions\u002Fsetup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0\n        with:\n          go-version: '1.22'\n          cache: true\n      - run: go build .\u002F...\n      - run: jq -n --arg sha \"${{ github.sha }}\" '{sha: $sha}' > deploy-meta.json\n      - uses: actions\u002Fupload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1\n        with:\n          name: deploy-meta\n          path: deploy-meta.json\n\n  release:\n    if: github.ref == 'refs\u002Fheads\u002Fmain' && github.event_name == 'push'\n    needs: [build]\n    permissions:\n      contents: write\n    steps:\n      - uses: actions\u002Fcheckout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0\n        with:\n          fetch-depth: 0\n      - run: npx semantic-release\n        env:\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n```\n\n---\n\n## Reference block 2 — deploy.yml (generic web app, excerpt)\n\n```yaml\nname: Deploy\non:\n  workflow_run:\n    workflows: [\"Test Build Release\"]\n    types: [completed]\n\npermissions:\n  contents: read\n  actions: read\n\nconcurrency:\n  group: deploy-production\n  cancel-in-progress: false\n\nenv:\n  SITE_URL: \"https:\u002F\u002FCHANGE-ME.example.com\"\n\njobs:\n  deploy:\n    if: >\n      github.event.workflow_run.conclusion == 'success' &&\n      github.event.workflow_run.head_branch == 'main'\n    runs-on: ubuntu-22.04\n    environment: production\n    steps:\n      - uses: actions\u002Fdownload-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1\n        with:\n          name: deploy-meta\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n          run-id: ${{ github.event.workflow_run.id }}\n          path: deploy-meta\n      # Placeholder deploy step — bigpowers ships no deploy templates and pins\n      # no third-party action. Substitute your platform's own step here, or drop\n      # the deploy job entirely for CLI and library repos. Pin whatever action\n      # you choose to a full commit SHA rather than a tag. (GH #104)\n      - name: Deploy\n        run: |\n          echo \"Replace this step with your platform's deploy command.\"\n          echo \"commit=$(jq -r .sha deploy-meta\u002Fdeploy-meta.json)\"\n          exit 1\n      - name: Health check\n        run: |\n          curl -sf \"${{ env.SITE_URL }}\" || exit 1\n```\n\n---\n\n## Reference block 3 — CLI dogfood (big-release pattern)\n\n```yaml\n  build:\n    needs: [test]\n    steps:\n      - run: make build\n      - uses: actions\u002Fupload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1\n        with:\n          name: big-release-${{ github.sha }}\n          path: bin\u002Fbig-release\n\n  release:\n    needs: [build]\n    if: github.ref == 'refs\u002Fheads\u002Fmain' && github.event_name == 'push'\n    steps:\n      - uses: actions\u002Fdownload-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1\n        with:\n          name: big-release-${{ github.sha }}\n          path: bin\n      - run: make release   # cross-compile assets only; host binary from artifact\n      - run: big-release release --verbose\n```\n\nNo `deploy.yml` — CLI publishes via the release job.\n\n---\n\n## Reference block 4 — validate script\n\n```bash\nfor f in .github\u002Fworkflows\u002F*.yml .github\u002Fworkflows\u002F*.yaml; do\n  [ -f \"$f\" ] || continue\n  python3 -c \"import yaml; yaml.safe_load(open('$f'))\" || echo \"FAIL: $f has YAML syntax errors\"\ndone\n\nfor f in .github\u002Fworkflows\u002Ftest-build-release.yml; do\n  if grep -q \"permissions:\" \"$f\"; then\n    echo \"OK: $f has permissions block\"\n  else\n    echo \"WARNING: $f missing permissions block\"\n  fi\ndone\n\nif grep -q 'workflows: \\[\"Test Build Release\"\\]' .github\u002Fworkflows\u002Fdeploy.yml 2>\u002Fdev\u002Fnull; then\n  if ! grep -q 'name: Test Build Release' .github\u002Fworkflows\u002Ftest-build-release.yml; then\n    echo \"WARNING: deploy.yml listens for Test Build Release but TBR name may differ\"\n  fi\nfi\n```\n\n---\n\n## Reference block 5 — dry-run\n\n```bash\nif command -v act &>\u002Fdev\u002Fnull; then\n  act push --dry-run -W .github\u002Fworkflows\u002Ftest-build-release.yml\nelif command -v gh &>\u002Fdev\u002Fnull; then\n  gh workflow run test-build-release.yml --ref \"$(git branch --show-current)\"\nelse\n  echo \"Install act or gh for dry-run\"\nfi\n```\n",{"name":5,"model":29,"description":7},"main","72f5e4c8b43f60cf86b37078ad8cd7e22daf67aa",".codex\u002Fskills\u002Fwire-ci",23,"https:\u002F\u002Fgithub.com\u002Fdanielvm-git\u002Fbigpowers","https:\u002F\u002Fdanielvm-git.github.io\u002Fbigpowers\u002F","https:\u002F\u002Fgithub.com\u002Fdanielvm-git","danielvm.net","2026-11-10 01:18:54",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add danielvm-git\u002Fbigpowers --skill wire-ci",{"tool":56,"command":57},"bunx","bunx skills add danielvm-git\u002Fbigpowers --skill wire-ci",{"tool":59,"command":60},"pnpm","pnpm dlx skills add danielvm-git\u002Fbigpowers --skill wire-ci","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdanielvm-git\u002Fbigpowers\u002Fblob\u002Fmain\u002F.codex\u002Fskills\u002Fwire-ci\u002FSKILL.md",true,[],[65,85,92,121,143,148],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":76,"publishedAt":36},"01M71KBG9F8X644MJB16H4V8M7","skill-verify-fail-open-fixture","Negative-path fixture for run-skill-verify.sh — must never PASS.","https:\u002F\u002Fgithub.com\u002Fdanielvm-git\u002Fbigpowers\u002Fblob\u002Fmain\u002Fspecs\u002Fverifications\u002Ffixtures\u002Fskill-verify-fail-open\u002FSKILL.md",[71],{"categoryNo":72,"categoryName":73,"taxonomyType":74,"taxonomyTypeDesc":75},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[77,78,79,80,81,82,83,27,84],"fixture","open","verify","skill verify fail open fixture","skill verify","path","run","never",{"skillNo":86,"name":87,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":36},"01M71KBE3BKEMKNE0C5DGVDWZH","negative-path","https:\u002F\u002Fgithub.com\u002Fdanielvm-git\u002Fbigpowers\u002Fblob\u002Fmain\u002Fspecs\u002Fverifications\u002Ffixtures\u002Fnegative-path\u002FSKILL.md",[],[91,82],"negative path",{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":101,"publishedAt":36},"01M71KBBGF7Y4EB4AMHBZ8CJFC","write-document","Write, organize, and sync high-integrity technical documents using the BMAD methodology. Ensures every document is Bold, Minimal, Actionable, and Durable. Use when creating architectural docs, technical guides, or organizing the specs\u002F directory.","https:\u002F\u002Fgithub.com\u002Fdanielvm-git\u002Fbigpowers\u002Fblob\u002Fmain\u002Fskills\u002Fwrite-document\u002FSKILL.md",[98],{"categoryNo":99,"categoryName":100,"taxonomyType":74,"taxonomyTypeDesc":75},"01JBSEEDCAT000000000000002","文档处理",[102,103,104,105,106,107,108,109,110,111,112,113,114,115,29,116,117,118,119,120],"write","write document","document","documents","actionable","technical","methodology","high","bmad","standard","use","when","minimal","bold","integrity","organize","sync","directory","guides",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":36},"01M71KB8TM089JJD5AY5KAFSDM","wire-observability","Add structured JSON logging, observability commands, and idempotent setup scripts to a project. Use when a project needs production-readiness instrumentation, when user wants structured logging, or as a production-readiness gate at any phase of development.","https:\u002F\u002Fgithub.com\u002Fdanielvm-git\u002Fbigpowers\u002Fblob\u002Fmain\u002Fskills\u002Fwire-observability\u002FSKILL.md",[],[28,128,129,111,130,112,131,132,133,134,29,135,136,137,138,139,140,113,141,142],"wire observability","readiness","commands","development","as","logging","add","instrumentation","at","structured logging","production-readiness","idempotent","phase","project","scripts",{"skillNo":144,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":36},"01M71KB6CNRANP449DQA3NJZ96","https:\u002F\u002Fgithub.com\u002Fdanielvm-git\u002Fbigpowers\u002Fblob\u002Fmain\u002Fskills\u002Fwire-ci\u002FSKILL.md",[],[19,20,33,34,35,32,23,21,22,24,25,111,26,27,28,29,30,31],{"skillNo":149,"name":150,"nameZh":6,"description":151,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":152,"categories":153,"keywords":165,"publishedAt":36},"01M71KB2ZV98P03X88QR8MT9F1","visual-dashboard","Start a browser-based dashboard that visualizes architecture, implementation plans, and project status. Persists artifacts in .bigpowers\u002Fdashboard\u002F. Reads specs\u002Fstate.yaml, release-plan.yaml, epics, and planning-status via HTTP API or opencode panel.","https:\u002F\u002Fgithub.com\u002Fdanielvm-git\u002Fbigpowers\u002Fblob\u002Fmain\u002Fskills\u002Fvisual-dashboard\u002FSKILL.md",[154,157,162],{"categoryNo":155,"categoryName":156,"taxonomyType":74,"taxonomyTypeDesc":75},"01JBSEEDCAT000000000000013","分析与可视化",{"categoryNo":158,"categoryName":159,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",{"categoryNo":163,"categoryName":164,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000033","数据分析师",[166,167,168,169,170,171,172,173,174,29,175,176,177,178,179,180,181,141,182,183],"dashboard","visual","visual dashboard","status","artifacts","http","plans","planning","panel","start","release","opencode","plan","browser","api","architecture","project status","http api"]