feat: add deploy-to-cloud-engine skill

[artkorotkikh-dfinity]

What

Adds deploy-to-cloud-engine (category Infrastructure): a skill that deploys an already-built ICP project to a user's own cloud engine (an OpenCloud / control-panel engine, administered from a web console). It:

• verifies the icp CLI is installed,
• checks existing CLI identities (icp identity list) and, when no engine identity exists, links the user's console identity with icp identity link web <name> --auth <console-origin> (the user completes the Internet Identity sign-in in the browser),
• defaults the console origin to https://opencloud.org (stated to the user and overridable when they sign in to a different console) and obtains the engine's subnet id, asking the user rather than guessing,
• deploys with icp deploy -e ic --subnet <subnet-id>,
• tags the canisters with __META_PROJECT / __META_NAME / __META_MAIN_CANISTER environment variables (via settings.environment_variables) so the engine console shows a single named app with labelled backend/frontend canisters and an "Open" button, instead of bare principal rows, and verifies the canisters on the console.

Includes evaluations/deploy-to-cloud-engine.json (output + trigger evals) covering the documented pitfalls: wrong or omitted --auth origin, the non-interactive "Press Enter" stall, deploying as anonymous, guessing the subnet id, dfx misuse, the console-naming metadata flow (naming an app + the "no Open button" case), and a marketplace-packaging near-miss that must not trigger this skill.

Why

The icp-cli skill covers general builds and mainnet deploys, but nothing covers the cloud-engine-specific path: linking the CLI to the engine's console identity, targeting the engine's own subnet, and tagging the canisters so the engine console shows them as one named app. This is the skill a coding agent links to so it can ship straight to a user's cloud engine — the flow the cloud-engine console currently spells out by hand.

Updates since opening

• Verified end-to-end against a real engine (opencloud.org console) on 2026-06-10: a coding agent following the skill linked the console identity and deployed a two-canister app successfully.
• Fixes harvested from that run: icp default → icp identity default (the former does not exist in icp 0.3.0), and documentation of the "Press Enter to log in" prompt that stalls icp identity link web in non-interactive shells.
• Console origin is now a stated default (https://opencloud.org) with an invited override, instead of an open-ended ask; the subnet id remains a hard ask.
• Added from CLI verification on icp 0.3.0: identity pre-check via icp identity list (the CLI cannot reveal which console an identity was linked against), a warning that omitting --auth silently links against its built-in default https://id.ai, the frontend URL form https://<canister-id>.icp0.io, and a compatibility pin to icp-cli >= 0.3.0.
• App metadata for the console (2026-06-11): added a step plus two pitfalls documenting the __META_PROJECT / __META_NAME / __META_MAIN_CANISTER environment variables that group CLI-deployed canisters into one named app (same __META_PROJECT across canisters), label each one, and mark the entry point (__META_MAIN_CANISTER: "true") for the "Open" button. Verified on the opencloud.org engine: icp-cli merges these with the auto-injected PUBLIC_CANISTER_ID:* variables, so the asset canister keeps serving. Added matching output evals (naming an app, "no Open button" adversarial) and two should_trigger queries.

⚠️ Draft — remaining before merge

• npm run validate — skill-validator was not available in my environment (no Go/Homebrew install). node scripts/check-project.js deploy-to-cloud-engine passes (metadata title/category present, eval file found, 0 warnings).
• Run the evaluation suite (node scripts/evaluate-skills.js deploy-to-cloud-engine) and paste results below.
• End-to-end verification of icp identity link web … and icp deploy -e ic --subnet … against a real engine — done 2026-06-10, see "Updates since opening".
• End-to-end verification of the __META_* console-naming metadata against a real engine — done 2026-06-11 (canisters merged the vars and rendered as a named app).

Evaluation results

Not yet generated. evaluations/deploy-to-cloud-engine.json is included (10 output evals + trigger evals, covering the deploy flow, the documented pitfalls, and the console-naming metadata); results need to be produced with node scripts/evaluate-skills.js deploy-to-cloud-engine before merge.

Per CONTRIBUTING, all PRs require repo-admin approval before merge.

[github-actions]

Skill Validation Report

Validating skill: /home/runner/work/icskills/icskills/skills/deploy-to-cloud-engine

Structure

• Pass: SKILL.md found

Frontmatter

• Pass: name: "deploy-to-cloud-engine" (valid)
• Pass: description: (973 chars)
• Pass: license: "Apache-2.0"
• Pass: compatibility: (127 chars)
• Pass: metadata: (2 entries)

Markdown

• Pass: no unclosed code fences found

Tokens

File	Tokens
SKILL.md body	2,505
Total	2,505

Content Analysis

Metric	Value
Word count	1,770
Code block ratio	0.05
Imperative ratio	0.11
Information density	0.08
Instruction specificity	0.94
Sections	9
List items	39
Code blocks	6

Contamination Analysis

Metric	Value
Contamination level	low
Contamination score	0.09
Primary language category	shell
Scope breadth	3

• Warning: Language mismatch: config (1 category differ from primary)

Result: passed

Project Checks

✓ Project checks passed for 1 skills (0 warnings)