Continuous integration

Use a secret-backed token in a trusted CI environment. Pin the CLI and application dependency versions through your package manager and lockfile.

# FLEXKIT_TOKEN comes from the CI secret store; the CLI reads it automatically
flexkit --local-config ./flexkit.config.ts deploy

Store FLEXKIT_TOKEN in the CI secret store. Commands that act on a project without a flexkit.config.ts read the project from FLEXKIT_PROJECT_ID. Do not print it or enable shell tracing around credential-bearing commands. The global options reference describes accepted CLI authentication and configuration selection.

Pipeline order

1. Install locked dependencies.
2. Validate and build the application configuration and examples.
3. Check the intended project selection and migration/export requirements.
4. Check the schema change with flexkit schema diff --exit-code (on pull requests), then deploy the schema and fail the job when deployment fails.
5. Deploy the application and its server environment.
6. Run a bounded read and verify tool discovery where applicable.

Separate development and production credentials. A successful application build does not establish that the target project schema was deployed; the host does not bundle flexkit.config.ts, and deploying the schema is what updates Studio. Avoid concurrent schema deployments to the same project from unrelated jobs.

See deployment and schema migrations.