菜单
Platform-agnostic CI/CD conventions. Covers pipeline stages, quality gates, environment promotion, secrets management, artifact handling, and deployment boundaries. Applied when configuring or reviewing CI/CD pipelines.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Scan a project for missing best-practice areas and implement the top recommendation for each gap (linting, unit testing) — installs tools, writes configs, verifies, and commits. Pass 'recommend' to stop after writing recommendations without implementing (replaces the old do-recommend skill).
Implement a focused code change. Use this skill as the wrapper for any implementation work so the Maverick workflow report captures what was done and so the agent applies the project's coding standards before editing. Intended to be invoked once per task from inside a do-issue-* or do-epic phase, not standalone.
Audit a codebase for security risks in one of two modes. In full-audit mode it scans the entire codebase and writes a findings report to docs/security-audit.md (run as part of do-init or on demand). In update mode it reviews only a diff plus the code it could impact, returning a structured findings list as a pre-push gate for do-issue-solo and do-issue-guided. Covers secrets exposure, dependency vulnerabilities, authentication and authorisation patterns, input validation, transport security, and common OWASP risks.
Create, restructure, or update technical documentation. Handles greenfield projects, refactoring non-compliant docs, and incremental updates after code changes.
Work on a multi-story GitHub epic end-to-end. Builds a DAG from the child stories, groups them into waves, runs waves in parallel via per-story worktrees, ejects PRs that fail agent-code-review for human handling, and propagates blocks to downstream stories. Requires git worktrees.
Initialise a project for use with Maverick — verifies the GitHub App, installs the CLI if needed, writes the project config with integration tracking, scaffolds docs, generates project skills, runs an initial cybersecurity audit, then commits the changes and opens a PR.
基于 SOC 职业分类
| name | mav-bp-cicd |
| description | Platform-agnostic CI/CD conventions. Covers pipeline stages, quality gates, environment promotion, secrets management, artifact handling, and deployment boundaries. Applied when configuring or reviewing CI/CD pipelines. |
| user-invocable | false |
| disable-model-invocation | true |
Pipeline standards and the post-push monitoring loop. CI is the last line of defence for autonomous work: it does not hallucinate, skip steps, or declare success prematurely.
[skip ci], no conditional
bypasses for "quick fixes".--no-verify, no force
merge, no editing gate config to get green (gate configuration is
infrastructure; see Boundaries).After every push, monitor the pipeline with the platform CLI, read the
failed job's logs, fix locally, and re-push. From a do-issue-*
workflow, use the bounded wait: uv run maverick pr wait <repo> <pr-num> --checks --timeout 30m.
| Platform | Status | Logs |
|---|---|---|
| GitHub Actions | gh run list --branch <br> / gh pr checks <pr> | gh run view <id> --log-failed |
| GitLab CI | glab ci status | glab ci trace <job> |
| Azure DevOps | az pipelines runs list --branch <br> | az pipelines runs show --id <id> |
| Bitbucket Pipelines | curl .../2.0/repositories/<ws>/<repo>/pipelines/?sort=-created_on | pipeline page / API step logs |
Anything genuinely project-specific (required checks, runner quirks, deploy targets) belongs in the project skill, not here.
Check docs/maverick/skills/cicd/SKILL.md for the project's pipeline
platform, stages, required checks, and deployment targets. If present,
it wins on specifics. If missing, proceed with these standards and note
the gap in your summary — do not trigger skill generation mid-task.
| Pattern | Issue | Fix |
|---|---|---|
| No CI pipeline in repository | No automated quality enforcement | Add pipeline with validate/build/test stages |
| Pipeline has no lint/typecheck stage | Style and type errors reach main | Add validate stage before build |
| Tests run but failures don't block merge | False confidence | Make test stage a required gate |
| Secrets in pipeline YAML or repo files | Security risk | Move to platform secret store |
| Pipeline rebuilds for each environment | Inconsistent artifacts | Build once, promote artifact |
| No manual gate for production deploy | Risk of unreviewed production changes | Add manual approval step |
| Pipeline takes >15 minutes | Developer productivity drain | Profile and optimise, add caching |
| Unpinned action/image versions | Non-reproducible builds | Pin to specific versions/SHAs |
Never, without explicit issue authorization (per
mav-scope-boundaries): create or modify pipeline
configuration, change stages/jobs/gates, touch CI secrets or environment
variables, or trigger production deployments. Always: monitor CI after
pushing and fix failures before declaring work complete.