smaqit-infrastructure-cicd-generate

name

smaqit.infrastructure-cicd-generate

description

Use when manually generating or updating the canonical 3-workflow GitHub Actions CI/CD set (deploy.yml, provision.yml, post-merge-deploy.yml) for a Node.js + React application deployed to a VM via Terraform and Docker Compose. Also use when an operator invokes /cicd.generate, or when updating existing workflows to match project conventions. In `smaqit.new-greenfield-project`, the deployment agent generates workflows during Phase 5 using these patterns as reference — invoke this skill directly only when generating CI/CD outside the zero-to-prod flow. Note: `copilot-setup-steps.yml` is provided by the smaqit framework and is not generated by this skill.

CI/CD Workflow Generator

Steps

1. Read existing workflows from .github/workflows/. If workflows exist and are substantially complete, offer to diff rather than overwrite.

2. Resolve configuration values from Infrastructure specs and copilot-instructions.md. Use these defaults if not found:

   Reference	Default
   VM host	${{ secrets.VM_HOST }}
   SSH key secret	VM_SSH_KEY
   Terraform backend	TF_BACKEND_ACCESS_KEY, TF_BACKEND_SECRET_KEY
   Cloud credentials	TF_VAR_APP_CREDENTIAL_ID, TF_VAR_APP_CREDENTIAL_SECRET
   GitHub token (Terraform)	GH_TERRAFORM_TOKEN
   Terraform path filter	deployment/terraform/**

3. Generate deploy.yml with two sequential jobs:

   • provision job: runs terraform apply. Env MUST include TF_VAR_github_token: ${{ secrets.GH_TERRAFORM_TOKEN }} — NOT GITHUB_TOKEN (reserved; runner overwrites it before steps execute).
   • deploy job: needs: [provision]. Steps in order: checkout → setup Node.js → install deps → build backend → build frontend (with VITE_DEMO_MODE: ${{ vars.VITE_DEMO_MODE }} on the build step) → rsync backend dist → rsync frontend dist → install node_modules on VM via Docker → write deploy stamps → docker compose restart → nginx reload.

4. Generate provision.yml with:

   • Trigger: pull_request, paths filter deployment/terraform/**
   • Single plan job: terraform plan only — NO terraform apply
   • Posts plan output as a PR comment
   • Same env vars as the provision job in deploy.yml, including TF_VAR_github_token

5. Generate post-merge-deploy.yml with:

   • Trigger: pull_request, types: [closed]
   • Condition: if: github.event.pull_request.merged == true && contains(github.event.pull_request.body, 'smaqit:deploy')
   • Action: trigger deploy.yml via workflow_dispatch
   • Do NOT use a label trigger — Copilot Coding Agent tokens lack issues:write and cannot apply labels.

6. Write all 3 files to .github/workflows/.

7. Report the list of files written with a brief description of each.

Output

• .github/workflows/deploy.yml — provision + deploy sequential jobs
• .github/workflows/provision.yml — PR-only terraform plan with PR comment
• .github/workflows/post-merge-deploy.yml — body sentinel trigger for deploy.yml

Scope

• Does NOT set up GitHub Secrets or Variables — use smaqit.infrastructure-repo-config for that.
• Does NOT provision infrastructure — Terraform runs inside the generated workflow.
• Does NOT handle matrix builds, monorepos, or container registry pushes.

Examples

Input: New project with no CI/CD workflows. Operator invokes /cicd.generate. Output: 4 files written to .github/workflows/. deploy.yml has sequential provision→deploy jobs; provision.yml is PR-only plan with PR comment; post-merge-deploy.yml uses body sentinel; copilot-setup-steps.yml has checkout.

Gotchas

• GITHUB_TOKEN is reserved — GitHub Actions runner injects its own short-lived installation token under GITHUB_TOKEN before any step executes, overwriting any env.GITHUB_TOKEN set by the workflow. Use TF_VAR_github_token; Terraform auto-maps TF_VAR_* → var.*.
• PR body sentinel, not label — Copilot Coding Agent tokens lack issues:write. post-merge-deploy.yml MUST use contains(github.event.pull_request.body, 'smaqit:deploy'), not a label check.
• provision.yml also needs TF_VAR_github_token — omitting it causes interactive prompt hangs in PR preview plans.
• copilot-setup-steps.yml must include actions/checkout@v4 — without checkout, the Coding Agent cannot read the codebase of a private repository.
• VITE_* vars are build-time — pass VITE_DEMO_MODE and any other VITE_* vars to the npm run build step, not the deploy step. Vite bakes them at compile time; they are not available at runtime.
• .terraform.lock.hcl must be committed — do NOT add it to .gitignore. If CI fails with provider version errors, check that this file is tracked in git.

Completion

• Existing workflows read (or confirmed absent)
• Configuration values resolved
• deploy.yml written (provision + deploy jobs, sequential, no GITHUB_TOKEN collision)
• provision.yml written (PR-only, plan only, path filter, TF_VAR_github_token present)
• post-merge-deploy.yml written (body sentinel, no label dependency)
• Report delivered

Failure Handling

Situation	Action
Required input not provided	Request the missing information before proceeding
Gathered input is ambiguous	Flag the ambiguity and ask for clarification
Subagent invocation fails	Report the failure with context; do not silently retry
Output artifact already exists	Confirm with user before overwriting
Workflows already exist and differ	Show a diff summary; ask whether to overwrite or merge
Infrastructure spec not available	Use defaults for all VM and Terraform references; note which values need to be updated post-generation
Configuration value ambiguous	Apply the documented default; annotate the generated file with a # TODO: verify comment