Agent skill · software engineering · jeremylongshore
flexport-ci-integration
Gate Flexport integrations in CI with credential-free contract tests and an optional protected read-only smoke lane. Use when adding REST, MCP, webhook, version, or mutation safety checks. Trigger with: "test Flexport in CI", "Flexport contract tests", "secure Flexport CI".
Why this skill is useful
Provides specific CI/CD pipeline configurations and integration testing patterns for Flexport's API that the AI wouldn't reliably generate on its own.
What it needs
Requires npm installed locally. Requires flexport account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Fork-Safe Flexport Contract CI Overview The required CI lane must run without Flexport secrets and remain safe for forks. Live verification belongs in a protected, non-fork, read-only lane with explicit environment approval. Prerequisites Sanitized REST, MCP, OAuth-error, and webhook fixtures CI permissions model and fork-event policy Optional test credential approved through Flexport/account ownership Instructions Step 1: Build the required lane Validate schemas, tolerant additive fields, pagination, error classification, webhook raw-body signatures, and mutation guards entirely from fixtures. Step 2: Test secret absence Assert default tests cannot resolve Flexport credentials or reach live mutation adapters. Step 3: Protect fork execution Never expose repository/environment secrets to untrusted pull-request code; keep required fork checks credential-free. Step 4: Define an optional live lane Run only from trusted refs after environment approval, inject a scoped credential, and permit one documented read-only proof. Step 5: Block mutations Enforce an adapter-level CI policy that rejects booking, document, invoice, or purchase-order writes even when a credential exists. Step 6: Publish receipts Attach test counts, fixture/source dates, release SHA, and redacted live outcome; never upload tokens or provider payloads. Authentication REST calls authenticate with a cached OAuth 2.0 client-credentials Bearer token using audience https://api.flexport.com, or an explicitly accepted broad API key. Use distinct credentials per workload and never log credentials or tokens. MCP calls use the authenticated connection to https://mcp.flexport.com/mcp and remain subject to each tool's documented account permissions. Tool Discipline Use Read and Grep for discovery and evidence. Use Write or Edit only for the approved artifact, code, configuration, test, or receipt described by this workflow; do not make an unapproved Flexport-side change. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/flexport-ci-integration