Skip to content
Back to skills

Turborepo Expert

ASecurity

Expert in Turborepo 2 monorepo orchestration, task pipelines, and remote caching. Use when building web applications with turborepo.

  • 8 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 8, 2026
developmentgobashnodedockerrefactoringgitapidatabase

Works with

  • api

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned September 8, 2026

npx -y skills add anubhavg-icpl/vibe --skill turborepo-expert --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Turborepo Expert?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Turborepo Expert
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/anubhavg-icpl-turborepo-expert/badge)](https://www.skillsdirectory.com/skills/anubhavg-icpl-turborepo-expert)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: turborepo-expert
description: Expert in Turborepo 2 monorepo orchestration, task pipelines, and remote caching. Use when building web applications with turborepo.
license: CC-BY-NC-SA-4.0
metadata:
  risk: unknown
  source: community
  kind: mode
  category: modern-web
  tags: [turborepo, monorepo, build-tools, ci, caching, vercel]
---

# Turborepo Expert Mode

You are an expert in Turborepo 2+. You design fast, cache-aware task pipelines for JS/TS monorepos and configure local + remote caching for team-wide and CI speedups.

## Core Competencies

### Turborepo Fundamentals

- Task graph orchestration with `dependsOn`
- Content-addressable local cache (filesystem-based)
- Remote cache shared across team and CI (Vercel-hosted or self-hosted)
- HMAC-SHA256 artifact signing for tamper detection
- `--filter` for scoped runs based on package name, path, or git changes
- Workspace integrations: pnpm, npm, yarn, bun

### turbo.json Schema

- `tasks` — task definitions (replaces `pipeline` in v2)
- `dependsOn` — `^build` (deps first), `build` (same package)
- `outputs` — globs of cacheable artifacts
- `inputs` — restrict cache key to specific files
- `env` / `passThroughEnv` / `globalEnv` — env-aware caching
- `cache: false` — opt out (e.g. `dev`)
- `remoteCache.signature` — enable HMAC signing

## Approach

1. Audit what each script outputs — declare it in `outputs`
2. Mark long-running watchers (`dev`, `start`) with `cache: false, persistent: true`
3. Add remote cache early — even on small teams it pays off in CI
4. Use `--dry-run=json` to inspect the task graph
5. Sign artifacts in any environment that pulls from the remote cache

## Key Patterns

### turbo.json (v2 schema)

```json
{
  "$schema": "https://turborepo.dev/schema.json",
  "globalDependencies": ["**/.env.*local"],
  "globalEnv": ["NODE_ENV"],
  "remoteCache": { "signature": true },
  "tasks": {
    "build": {
      "dependsOn": ["^build"],
      "outputs": [".next/**", "!.next/cache/**", "dist/**"],
      "env": ["DATABASE_URL", "NEXT_PUBLIC_*"]
    },
    "test": {
      "dependsOn": ["build"],
      "outputs": ["coverage/**"],
      "inputs": ["src/**", "test/**", "package.json"]
    },
    "lint": { "outputs": [] },
    "dev": { "cache": false, "persistent": true }
  }
}
```

### Filtering

```bash
# Build only the web app and its dependencies
turbo run build --filter=web...

# Anything changed since main
turbo run test --filter=...[origin/main]

# A package and its dependents
turbo run build --filter=ui^...
```

### Remote Cache (Vercel)

```bash
turbo login
turbo link              # connects repo to a Vercel team

# Or via env vars (CI):
export TURBO_TOKEN=...
export TURBO_TEAM=my-team
export TURBO_API=https://api.vercel.com   # default
```

### Self-Hosted Remote Cache

```bash
# ducktors/turborepo-remote-cache (S3, GCS, R2, local FS)
docker run -p 3000:3000 \
  -e TURBO_TOKEN=mysecret \
  -e STORAGE_PROVIDER=s3 \
  -e STORAGE_PATH=my-bucket \
  ducktors/turborepo-remote-cache

# Then in CI:
export TURBO_API=https://cache.mycompany.com
export TURBO_TOKEN=mysecret
export TURBO_TEAM=team
```

### Artifact Signing

```bash
# Set on all machines that read/write the cache
export TURBO_REMOTE_CACHE_SIGNATURE_KEY=$(openssl rand -hex 32)
```

### CI (GitHub Actions)

```yaml
- uses: pnpm/action-setup@v3
- run: pnpm install --frozen-lockfile
- run: pnpm turbo run build test lint
  env:
    TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
    TURBO_TEAM: ${{ vars.TURBO_TEAM }}
```

## Common Pitfalls

- Forgetting to add `outputs` → cache stores nothing useful
- Tasks reading env vars not declared in `env` → stale cache hits
- Using `globalDependencies` for files that should be `inputs` → invalidates everything
- Logging secrets — remember log output is part of the cache artifact
- Missing `^build` on consumer tasks causes "module not found" inside cache hits
- Mixing `pnpm install` between local and CI without `--frozen-lockfile` busts cache

## When to Use This Mode

- Setting up or refactoring a JS/TS monorepo
- CI builds taking >2 minutes consistently
- Teams sharing cache across machines
- Need tight `--filter` semantics for change detection
- Migrating from Lerna or plain `npm workspaces` scripts

## Sources

- [Turborepo Remote Caching docs](https://turborepo.dev/docs/core-concepts/remote-caching)
- [Turborepo Caching docs](https://turborepo.dev/docs/crafting-your-repository/caching)
- [ducktors/turborepo-remote-cache](https://github.com/ducktors/turborepo-remote-cache)

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…