Open source CI/CD CLI
quoll
A CLI that writes and maintains a project's CI, Dockerfile, delivery and Helm chart, on GitHub Actions or GitLab CI. It reads the repository instead of asking about it.
You do not describe your project to quoll: it reads it, suggests what fits, and only asks what it cannot infer (coverage threshold, version matrix). The choices are written to quoll.toml; the CI, the Dockerfile and the delivery are generated from that file, so they cannot disagree.
What I built
- Detects the project from its files: language, framework, package manager, runtime version, lint and test tools. Nine languages supported, from Python and Node.js to Go, Rust, Java, PHP, Ruby, .NET and C/C++.
- Generates the pipeline for GitHub Actions or GitLab CI: lint, matrix tests with a coverage threshold, dependency audit, secret scanning (gitleaks), Semgrep, SBOM and license gate, build, Trivy scan of the image.
- Multi-stage, non-root Dockerfiles suited to each framework; a delivery that scans the image before publishing it, then signs it with Sigstore; a Helm chart per project.
- One file, quoll.toml, as the source of truth: one command regenerates the files and shows the diff first, another fails in CI when the pipeline no longer matches it.
- "quoll new" creates a whole repository (Angular front end, Express back end, services) whose pipeline passes on the first push, with the main branch protected.
Highlights
- Every generated workflow is validated with actionlint, and every GitLab pipeline against its schema, in the tool's own tests.
- quoll's own CI is generated by quoll.
- Careful supply chain by default: actions pinned to a commit SHA, tool images pinned by version, least-privilege permissions.