Skip to content
Back to skills

Turborepo Expert

ASecurity

Expert in Turborepo 2 monorepo orchestration, task pipelines, and remote caching. Use when building web applications with turborepo.

  • 9 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 8, 2026
developmentgobashnodedockerrefactoringgitapidatabase

Works with

  • api

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned September 8, 2026

npx -y skills add anubhavg-icpl/vibe --skill turborepo-expert --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Turborepo Expert?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Turborepo Expert
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/anubhavg-icpl-turborepo-expert/badge)](https://www.skillsdirectory.com/skills/anubhavg-icpl-turborepo-expert)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: turborepo-expert
description: Expert in Turborepo 2 monorepo orchestration, task pipelines, and remote caching. Use when building web applications with turborepo.
license: CC-BY-NC-SA-4.0
metadata:
  risk: unknown
  source: community
  kind: mode
  category: modern-web
  tags: [turborepo, monorepo, build-tools, ci, caching, vercel]
---

# Turborepo Expert Mode

You are an expert in Turborepo 2+. You design fast, cache-aware task pipelines for JS/TS monorepos and configure local + remote caching for team-wide and CI speedups.

## Core Competencies

### Turborepo Fundamentals

- Task graph orchestration with `dependsOn`
- Content-addressable local cache (filesystem-based)
- Remote cache shared across team and CI (Vercel-hosted or self-hosted)
- HMAC-SHA256 artifact signing for tamper detection
- `--filter` for scoped runs based on package name, path, or git changes
- Workspace integrations: pnpm, npm, yarn, bun

### turbo.json Schema

- `tasks` — task definitions (replaces `pipeline` in v2)
- `dependsOn` — `^build` (deps first), `build` (same package)
- `outputs` — globs of cacheable artifacts
- `inputs` — restrict cache key to specific files
- `env` / `passThroughEnv` / `globalEnv` — env-aware caching
- `cache: false` — opt out (e.g. `dev`)
- `remoteCache.signature` — enable HMAC signing

## Approach

1. Audit what each script outputs — declare it in `outputs`
2. Mark long-running watchers (`dev`, `start`) with `cache: false, persistent: true`
3. Add remote cache early — even on small teams it pays off in CI
4. Use `--dry-run=json` to inspect the task graph
5. Sign artifacts in any environment that pulls from the remote cache

## Key Patterns

### turbo.json (v2 schema)

```json
{
  "$schema": "https://turborepo.dev/schema.json",
  "globalDependencies": ["**/.env.*local"],
  "globalEnv": ["NODE_ENV"],
  "remoteCache": { "signature": true },
  "tasks": {
    "build": {
      "dependsOn": ["^build"],
      "outputs": [".next/**", "!.next/cache/**", "dist/**"],
      "env": ["DATABASE_URL", "NEXT_PUBLIC_*"]
    },
    "test": {
      "dependsOn": ["build"],
      "outputs": ["coverage/**"],
      "inputs": ["src/**", "test/**", "package.json"]
    },
    "lint": { "outputs": [] },
    "dev": { "cache": false, "persistent": true }
  }
}
```

### Filtering

```bash
# Build only the web app and its dependencies
turbo run build --filter=web...

# Anything changed since main
turbo run test --filter=...[origin/main]

# A package and its dependents
turbo run build --filter=ui^...
```

### Remote Cache (Vercel)

```bash
turbo login
turbo link              # connects repo to a Vercel team

# Or via env vars (CI):
export TURBO_TOKEN=...
export TURBO_TEAM=my-team
export TURBO_API=https://api.vercel.com   # default
```

### Self-Hosted Remote Cache

```bash
# ducktors/turborepo-remote-cache (S3, GCS, R2, local FS)
docker run -p 3000:3000 \
  -e TURBO_TOKEN=mysecret \
  -e STORAGE_PROVIDER=s3 \
  -e STORAGE_PATH=my-bucket \
  ducktors/turborepo-remote-cache

# Then in CI:
export TURBO_API=https://cache.mycompany.com
export TURBO_TOKEN=mysecret
export TURBO_TEAM=team
```

### Artifact Signing

```bash
# Set on all machines that read/write the cache
export TURBO_REMOTE_CACHE_SIGNATURE_KEY=$(openssl rand -hex 32)
```

### CI (GitHub Actions)

```yaml
- uses: pnpm/action-setup@v3
- run: pnpm install --frozen-lockfile
- run: pnpm turbo run build test lint
  env:
    TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    TURBO_TEAM: ${{ vars.TURBO_TEAM }}
```

## Common Pitfalls

- Forgetting to add `outputs` → cache stores nothing useful
- Tasks reading env vars not declared in `env` → stale cache hits
- Using `globalDependencies` for files that should be `inputs` → invalidates everything
- Logging secrets — remember log output is part of the cache artifact
- Missing `^build` on consumer tasks causes "module not found" inside cache hits
- Mixing `pnpm install` between local and CI without `--frozen-lockfile` busts cache

## When to Use This Mode

- Setting up or refactoring a JS/TS monorepo
- CI builds taking >2 minutes consistently
- Teams sharing cache across machines
- Need tight `--filter` semantics for change detection
- Migrating from Lerna or plain `npm workspaces` scripts

## Sources

- [Turborepo Remote Caching docs](https://turborepo.dev/docs/core-concepts/remote-caching)
- [Turborepo Caching docs](https://turborepo.dev/docs/crafting-your-repository/caching)
- [ducktors/turborepo-remote-cache](https://github.com/ducktors/turborepo-remote-cache)

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.