ci-validation-gates

Enforce semver validation, token checks, retry logic, and draft handling in CI/CD workflows.

3|3|Updated Apr 13, 2026
One-click install
npx skills add https://github.com/quaid-app/quaid --skill ci-validation-gates-quaid-app
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ci-validation-gates
Source: https://github.com/quaid-app/quaid/tree/main/.copilot/skills/ci-validation-gates
Command: npx skills add https://github.com/quaid-app/quaid --skill ci-validation-gates-quaid-app

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

CI workflows must be defensive. These patterns were learned from the v0.8.22 release disaster where invalid semver, wrong token types, missing retry logic, and draft releases caused a multi-hour outage. Both Drucker (CI/CD) and Trejo (Release Manager) carried this knowledge in their charters — now centralized here.

Core Features & Use Cases

  • Semver validation: enforce correct versioning before publish
  • NPM token type verification: ensure automation tokens are used in CI
  • Retry logic for registry propagation: handle eventual consistency after publish
  • Draft release detection: avoid acting on draft releases in workflows

Quick Start

Run the defensive CI checks as part of your release pipeline to catch issues before deployment.

Frequently Asked Questions about ci-validation-gates

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent CI/CD outages from invalid semver or wrong npm tokens?

Prevent CI/CD outages by applying defensive patterns like semver validation and npm token type verification in your GitHub Actions workflows. These deterministic checks catch invalid versions and wrong token types before deployment.

What causes npm publish failures due to registry propagation delays?

Registry propagation delays cause npm publish failures due to eventual consistency after release. Implementing retry logic in your CI pipeline handles this by automatically re-checking the registry until the published version becomes available.

How do I stop GitHub Actions from running on draft releases?

Stop GitHub Actions from running on draft releases by adding draft release detection to your workflow guardrails. This check identifies and skips draft releases, preventing premature deployment actions and avoiding potential pipeline outages.

Can I use these defensive CI/CD patterns with existing GitHub Actions pipelines?

Yes, you can use these defensive CI/CD patterns with existing GitHub Actions pipelines. They are designed as config-driven guardrails that integrate into release workflows to enforce deterministic checks like semver validation and token verification.

Why do I need automation token type checks in CI workflows?

You need automation token type checks in CI workflows to ensure automation tokens are used instead of personal tokens. Using the wrong npm token type can cause authentication failures and outages during automated publish scenarios.