Hoist

Generate secure, low-infrastructure release pipelines that publish artifacts directly — language packages (npm, PyPI, crates, RubyGems, NuGet, Go), GitHub Releases with binaries, static sites/Pages, or serverless functions — without building a container image. OIDC/trusted publishing, provenance, idempotent publish guards, and three trigger models (auto-bump with optional approval, tag, manual). The non-container sibling of /dock. Use when releasing a package or app that doesn't ship as a container.From its SKILL.md

Install

npx -y skills add slamb2k/mad-skills --skill hoist

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

4.2 KB, as published. Nobody here has run it

Hoist - Non-Container Release Pipelines

When this skill is invoked, IMMEDIATELY output the banner below before doing anything else. Pick ONE tagline at random — vary your choice each time. CRITICAL: Reproduce the banner EXACTLY character-for-character, including the diagonal / glyph before the name.

{tagline}

       /$$ /$$   /$$  /$$$$$$  /$$$$$$  /$$$$$$  /$$$$$$$$
      /$$/| $$  | $$ /$$__  $$|_  $$_/ /$$__  $$|__  $$__/
     /$$/ | $$  | $$| $$  \ $$  | $$  | $$  \__/   | $$   
    /$$/  | $$$$$$$$| $$  | $$  | $$  |  $$$$$$    | $$   
   /$$/   | $$__  $$| $$  | $$  | $$   \____  $$   | $$   
  /$$/    | $$  | $$| $$  | $$  | $$   /$$  \ $$   | $$   
 /$$/     | $$  | $$|  $$$$$$/ /$$$$$$|  $$$$$$/   | $$   
|__/      |__/  |__/ \______/ |______/ \______/    |__/

Taglines:

📦 Up and away — published!
🏗️ Hoisting your release skyward!
🚀 From main to registry in one pull!
🪝 Latched on, lifting off!
⬆️ Straight to the top shelf!
🎁 Wrapped, signed, and shipped!
🛎️ Release, served fresh!
🔖 Tag it and bag it!

Flags

--skip-interview: detected + platform-aware defaults
--dry-run: show generated files without writing
--registry <name>: force the target registry

Output Formatting

(Input box, Pre-flight table, stage headers, status icons — copy the conventions from skills/dock/SKILL.md.)

Pre-flight

6-column dependency table: git (required, stop), gh (optional for GitHub release ops), sync (optional skill, fallback git pull), node/language toolchain (optional, detected). Follow the resolution-strategy list format used by other skills.

Platform Detection

Detect github vs azdo from the remote URL (same block as skills/dock/SKILL.md).

Phase 0: Sync

Invoke /sync (fallback git pull).

Phase 1: Detection

Explore subagent using references/interview-guide.md#detection-prompt → DETECTION_REPORT.

Phase 2: Interview

Follow references/interview-guide.md#interview-questions. Compile HOIST_CONFIG (target, registry/host, trigger model, approval gate, signing).

Phase 3: Generate

Read references/release-templates.md and references/hardening.md. Emit the CI workflow for the detected target + chosen trigger (secure by default: id-token, provenance, idempotent publish guard, concurrency; token exceptions per hardening.md). For binaries, add SHA256SUMS + optional signing. Generate deploy/SETUP.md from references/setup-guides.md.

Phase 4: Verify

Validate workflow YAML. Confirm the generated workflow carries the required hardening for its target (OIDC/id-token: write or a flagged token secret; provenance where supported; the version-exists guard; publish-before-tag). --dry-run previews without writing.

Final Report

Box report with target, trigger model, generated files, and a 🔐 Required setup section pointing at deploy/SETUP.md.

After presenting the report, record lifecycle completion and surface the next step:

_R="${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/plugins/marketplaces/slamb2k}"
node "$_R/hooks/session-guard.cjs" lifecycle-complete hoist

If the command prints a LIFECYCLE_OFFER_BEGIN…END block, present that offer to the user via AskUserQuestion as instructed inside the block. If it prints nothing (or LIFECYCLE_OFFER_NONE), do not mention the lifecycle engine.

Integration

Complements /dock (containers) — pick whichever fits. Runs after /rig; /ship's merge can trigger the generated auto-bump release. Only the serverless target may reference /keel for cloud identity.