# Hoist

> Generate secure, low-infrastructure release pipelines that publish artifacts directly — language packages (npm, PyPI, crates, RubyGems, NuGet, Go), GitHub Releases with binaries, static sites/Pages, or serverless functions — without building a container image. OIDC/trusted publishing, provenance, idempotent publish guards, and three trigger models (auto-bump with optional approval, tag, manual). The non-container sibling of /dock. Use when releasing a package or app that doesn't ship as a container.

- Skill: `slamb2k/hoist` (Agent Skill, multi-file: 6 files)
- Install (CLI): `npx skillmds@latest add slamb2k/hoist`
- Raw SKILL.md: https://api.skillmd.com/api/skills/slamb2k/hoist/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: slamb2k (https://skillmd.com/u/slamb2k)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/slamb2k/hoist

---


# Hoist - Non-Container Release Pipelines

When this skill is invoked, IMMEDIATELY output the banner below before doing anything else.
Pick ONE tagline at random — vary your choice each time.
CRITICAL: Reproduce the banner EXACTLY character-for-character, including the diagonal `/` glyph before the name.

```
{tagline}

       /$$ /$$   /$$  /$$$$$$  /$$$$$$  /$$$$$$  /$$$$$$$$
      /$$/| $$  | $$ /$$__  $$|_  $$_/ /$$__  $$|__  $$__/
     /$$/ | $$  | $$| $$  \ $$  | $$  | $$  \__/   | $$   
    /$$/  | $$$$$$$$| $$  | $$  | $$  |  $$$$$$    | $$   
   /$$/   | $$__  $$| $$  | $$  | $$   \____  $$   | $$   
  /$$/    | $$  | $$| $$  | $$  | $$   /$$  \ $$   | $$   
 /$$/     | $$  | $$|  $$$$$$/ /$$$$$$|  $$$$$$/   | $$   
|__/      |__/  |__/ \______/ |______/ \______/    |__/   
```

Taglines:
- 📦 Up and away — published!
- 🏗️ Hoisting your release skyward!
- 🚀 From main to registry in one pull!
- 🪝 Latched on, lifting off!
- ⬆️ Straight to the top shelf!
- 🎁 Wrapped, signed, and shipped!
- 🛎️ Release, served fresh!
- 🔖 Tag it and bag it!

## Flags
- `--skip-interview`: detected + platform-aware defaults
- `--dry-run`: show generated files without writing
- `--registry <name>`: force the target registry

## Output Formatting
(Input box, Pre-flight table, stage headers, status icons — copy the conventions
from skills/dock/SKILL.md.)

## Pre-flight
6-column dependency table: git (required, stop), gh (optional for GitHub release
ops), sync (optional skill, fallback git pull), node/language toolchain (optional,
detected). Follow the resolution-strategy list format used by other skills.

## Platform Detection
Detect github vs azdo from the remote URL (same block as skills/dock/SKILL.md).

## Phase 0: Sync
Invoke /sync (fallback git pull).

## Phase 1: Detection
Explore subagent using references/interview-guide.md#detection-prompt → DETECTION_REPORT.

## Phase 2: Interview
Follow references/interview-guide.md#interview-questions. Compile HOIST_CONFIG
(target, registry/host, trigger model, approval gate, signing).

## Phase 3: Generate
Read references/release-templates.md and references/hardening.md. Emit the CI
workflow for the detected target + chosen trigger (secure by default: id-token,
provenance, idempotent publish guard, concurrency; token exceptions per
hardening.md). For binaries, add SHA256SUMS + optional signing. Generate
deploy/SETUP.md from references/setup-guides.md.

## Phase 4: Verify
Validate workflow YAML. Confirm the generated workflow carries the required
hardening for its target (OIDC/`id-token: write` or a flagged token secret;
provenance where supported; the version-exists guard; publish-before-tag).
--dry-run previews without writing.

## Final Report
Box report with target, trigger model, generated files, and a 🔐 Required setup
section pointing at deploy/SETUP.md.

After presenting the report, record lifecycle completion and surface the next step:
```bash
_R="${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/plugins/marketplaces/slamb2k}"
node "$_R/hooks/session-guard.cjs" lifecycle-complete hoist
```
If the command prints a `LIFECYCLE_OFFER_BEGIN…END` block, present that offer to
the user via AskUserQuestion as instructed inside the block. If it prints nothing
(or `LIFECYCLE_OFFER_NONE`), do not mention the lifecycle engine.

## Integration
Complements /dock (containers) — pick whichever fits. Runs after /rig; /ship's
merge can trigger the generated auto-bump release. Only the serverless target may
reference /keel for cloud identity.