Shipyard detects your stack and generates production-ready CI/CD workflows, secure Dockerfiles, and preflight checklists. No YAML from scratch.
1
Command
Detects stack automatically
6+
CI platforms
GitHub Actions, GitLab, Bitbucket...
Hardened
Docker security
Non-root, healthcheck, layer cache
Preflight
Production check
Env vars, CORS, monitoring
Writing GitHub Actions workflows from memory means missing caches, wrong Node versions, no concurrency control, and missing permissions blocks.
Running as root, using :latest tags, exposing secrets in build args, poor layer caching — common mistakes that pass until a security audit catches them.
Environment variables, health endpoints, error monitoring, CORS, rate limiting — teams discover missing config in production, not before.
Preflight is a pass/fail check — each item either passes or blocks with an explicit reason and a fix path, not a reading list to act on later.
Shipyard reads your package.json, detects your framework and package manager, and generates production-ready workflows with proper caching, concurrency control, least-privilege permissions, and timeout management. Dockerfiles are multi-stage with security best practices. The preflight checklist verifies everything before you deploy.
Measured in the field: 49 production releases of Composure itself shipped through a fully hook-driven pipeline in 11 weeks — commit on main, build, publish, deploy — including three releases in a single day. One of them closed out a nine-hour campaign session:
$/shipyard:ci-generate$→ Detected: Next.js 16 + pnpm + Vercel$→ Generated: .github/workflows/ci.yml$ Stages: lint → typecheck → test → build → deploy$ Cache: pnpm store + .next cache$ Concurrency: cancel-in-progress$ Permissions: contents: read$ Timeout: 10 minutes$/shipyard:dockerfile$→ Multi-stage build (builder + runner)$→ Non-root user, HEALTHCHECK, .dockerignore$→ Validated with hadolint: 0 issuesShipyard reads package.json, config files, and deployment targets (Vercel, Netlify, Fly.io, Docker, Kubernetes) to understand your exact setup.
Creates a complete workflow file with proper caching, concurrency, permissions, timeouts, and multi-stage job chains. Shows diff before overwriting existing workflows.
Generates or validates Dockerfiles with multi-stage builds, non-root users, healthchecks, and .dockerignore. Framework-specific patterns for Next.js, Vite, FastAPI, Go, and Rust.
Checks environment variables, health endpoints, error monitoring, CORS, rate limiting, and security headers. Catches config issues before they reach production.