/alibabacloud-devops

name: alibabacloud-devops
description: |
  Automate Alibaba Cloud Yunxiao DevOps tasks — create and run pipelines, manage code repositories
  and merge requests, track work items and sprints, create test cases, manage artifacts, and drive
  application release workflows across 8 Yunxiao products.
  Triggers: "Yunxiao", "DevOps", "pipeline", "code repository", "merge request", "work item", "sprint", "test case", "application delivery", "artifact repository", "Codeup", "Flow", "Projex", "AppStack", "Packages", "Testhub"

Intelligent DevOps Execution via Yunxiao Tools

This skill translates natural-language DevOps requests into Alibaba Cloud Yunxiao API calls. It supports three invocation channels: Alibaba Cloud CLI (`aliyun devops`), MCP Server, and mcporter CLI. It covers 8 Yunxiao products (~388 CLI commands, ~165 MCP tools).

1. Overview

• **Core flow**: Intent classification → Ambiguity resolution → Product mapping → Reference reading → Tool execution → Result verification
• **Scope**: CI/CD, code management, project collaboration, sprints/work items, artifacts, testing, application delivery

For the full product and tool catalog (MCP tools and CLI commands by product), see [references/tool-catalog.md](references/tool-catalog.md).

---

2. Prerequisites

> **[MUST] Execution order is mandatory.** Steps in this section form a sequential decision tree. You **MUST** execute them in the numbered order below. **Do NOT** check Node.js, MCP, or mcporter availability until the CLI path (Steps 1–4) has been fully attempted and failed. **Do NOT** run any checks in parallel across subsections 2.1 and 2.2.

> **Token Security Rules (applies to ALL channels):** > - **NEVER** ask users to paste plaintext tokens in conversation or command line > - **NEVER** read/print token values using `echo` or similar commands > - **ONLY** verify token existence via check (see steps below for channel-specific env var names) > - **If token is not configured, STOP** and guide user to [Yunxiao Personal Access Token](https://help.aliyun.com/zh/yunxiao/developer-reference/obtain-personal-access-token). Required scopes: Organization Management (R/W), Project Collaboration (R/W), Code Management (R/W), Pipeline (R/W), Packages (R/W), Application Delivery (R/W), Test Management (R/W).

2.1 CLI Channel Setup (Primary — MUST complete first)

> The Alibaba Cloud CLI (`aliyun devops`) is the **primary** invocation channel. MCP Server and mcporter are fallbacks only. Full configuration guide: [references/aliyun-cli-setup.md](references/aliyun-cli-setup.md).

**Step 1: CLI availability check**

aliyun devops --help >/dev/null 2>&1 && echo "cli ready" || echo "cli not available"

• Available → Go to **Step 3**
• Not available → Go to **Step 2** (attempt installation)

**Step 2: [MUST] Attempt CLI installation**

> **[MUST]** If CLI is not found in Step 1, you **MUST** attempt installation before considering any fallback channel. Skipping this step is prohibited. Full installation guide: [references/aliyun-cli-install.md](references/aliyun-cli-install.md).

1. **Detect OS and install**:

• **macOS (Homebrew available):**

     brew install aliyun-cli

• **macOS / Linux (no Homebrew):**

     /bin/bash -c "$(curl -fsSL https://aliyuncli.alicdn.com/install.sh)"

• **Windows (PowerShell):** Guide user to download and run the PowerShell install script. See [references/aliyun-cli-install.md](references/aliyun-cli-install.md).

2. **Verify installation and re-check**:

   aliyun version
   aliyun devops --help >/dev/null 2>&1 && echo "cli ready" || echo "cli not available"

• Available → Go to **Step 3**
• Still not available → Go to **Section 2.2 Fallback**

**Step 3: Authentication and site type detection**

Cloud DevOps (Yunxiao) uses **Personal Access Token** for authentication, not AK/SK profiles.

**3a. Check token:**

[ -n "$ALIBABA_CLOUD_YUNXIAO_ACCESS_TOKEN" ] && echo "token configured" || echo "token missing"

If token is missing, guide user to configure based on their site type:

**Central site (default) — token + organization ID:**

export ALIBABA_CLOUD_YUNXIAO_ACCESS_TOKEN=<your-personal-access-token>
export ALIBABA_CLOUD_YUNXIAO_ORGANIZATION_ID=<your-organization-id>

**Region site — token + region API base URL:**

export ALIBABA_CLOUD_YUNXIAO_ACCESS_TOKEN=<your-personal-access-token>
export ALIBABA_CLOUD_YUNXIAO_API_BASE_URL=<your-region-api-base-url>

> **[MUST] Never ask the user for an API base URL on the central site** — it defaults to `openapi-rdc.aliyuncs.com` (for both the CLI and the MCP Server). The base URL is a region-site-only setting.

Recommend adding these to the user's shell profile (`~/.bashrc`, `~/.zshrc`, etc.) for persistence.

**3b. Detect site type:**

After token is confirmed, detect the site type:

[ -n "$ALIBABA_CLOUD_YUNXIAO_API_BASE_URL" ] && echo "region site" || echo "central site (default)"
[ -n "$ALIBABA_CLOUD_YUNXIAO_ORGANIZATION_ID" ] && echo "org id configured" || echo "org id missing"

• `ALIBABA_CLOUD_YUNXIAO_API_BASE_URL` set → **Region site**: subsequent CLI calls do **NOT** use `--organization-id`; the API base URL is read from the environment variable automatically
• Not set → **Central site (default)**: subsequent CLI calls use `--organization-id`; if the org id is missing, guide user to set `ALIBABA_CLOUD_YUNXIAO_ORGANIZATION_ID` (it can be looked up via `aliyun devops base-get-user-by-token`)

> **[MUST]** Remember the detected site type. All subsequent CLI calls in this session must use the corresponding parameter pattern. **CLI parameters use kebab-case** (e.g., `--organization-id`), not camelCase (`--organizationId`).

**Step 4: [MUST] Disable the interactive plugin-install prompt**

The `devops` commands live in the `aliyun-cli-devops` plugin, which is **not** bundled with a fresh CLI install. The first `aliyun devops <business-comm