bc-gov-deployment-cicd-analyst

name	bc-gov-deployment-cicd-analyst
description	Generic BC Gov deployment and CI/CD assessment orchestrator for SaaS, container, and hybrid delivery pipelines. Use when producing evidence-based deployment governance reports, control matrices, remediation roadmaps, and executive summaries across platforms such as GitHub Actions, Bitbucket Pipelines, Azure DevOps, and GitLab CI.
tools	Bash, Read, Write, Grep, Glob, agent
user-invocable	true
metadata	{"author":"Ryan Loiselle","version":"1.0"}
compatibility	BC Gov assessments across OpenShift and non-OpenShift environments. Supports SaaS delivery patterns (for example Salesforce force.com), container platforms, and hybrid enterprise delivery models.

BC Gov Deployment and CI/CD Analyst

Repeatable analysis workflow for deployment and CI/CD governance assessments.

This skill is platform-agnostic and report-oriented. It is designed to produce consistent, evidence-traceable findings and client-ready outputs.

Use When

• Review deployment process against BC Gov policy intent
• Assess CI/CD controls and identify gaps
• Produce severity-ranked findings and remediation plan
• Create executive summary and client-facing report package
• Compare SaaS pipeline controls to BC Gov DevOps/security guidance
• Build control mapping matrix with owner and timeline

Don't Use When

• The request is purely implementation coding with no assessment/reporting need
• The user needs only a single pipeline command fix without governance analysis
• The engagement is an application feature review unrelated to deployment or CI/CD

Workflow

1. Intake and scope

• Confirm scope boundaries (pipeline/process versus application code behavior).
• Confirm target delivery model (SaaS, OpenShift, hybrid).
• Identify required outputs and audience (technical, executive, governance).

2. Evidence capture

• Extract machine-readable source content from provided artifacts.
• Build evidence map with line-level references.
• Validate external platform behavior only where needed and cite sources.

3. Control analysis

• Assess release integrity and determinism.
• Assess segregation, quality gates, secrets lifecycle, approvals, supply chain, audit retention, rollback readiness.

4. Findings and roadmap

• Produce severity-ranked findings (Critical, High, Medium, Low).
• Provide recommendation per finding.
• Build phased roadmap (0-30, 31-90, 90+ days).
• Assign owner candidates by control domain.

5. Client packaging

• Produce full report, executive summary, one-page brief, control matrix, and process artifacts.

Rules

1. Collect evidence first, map controls second, recommend actions third.
2. Do not publish findings without direct evidence references.
3. For non-OpenShift SaaS environments, map BC Gov standards by control intent, not Kubernetes implementation details.
4. Explicitly document assumptions and boundary conditions.
5. Every Critical/High finding must include a concrete remediation action and owner suggestion.

Examples

Example 1: SaaS pipeline assessment

• Input: Bitbucket pipeline PDF for Salesforce multi-tenant deployment
• Action: Extract content, map controls, run security/network/CI-CD analyst passes, produce findings and roadmap
• Output: Technical report, executive summary, one-page brief, control matrix

Example 2: Hybrid CI/CD governance review

• Input: GitHub Actions workflows and deployment docs for container + SaaS services
• Action: Assess release integrity, approvals, secrets, evidence retention, and supply-chain controls
• Output: Severity-ranked findings and phased remediation plan

Edge Cases

1. Source artifact is image-only PDF -> use OCR or request machine-readable export before finalizing conclusions.
2. Missing governance data (approvals/branch protections) -> record as assumption gap and mark findings as provisional.
3. Mixed delivery models in one engagement -> split findings by platform context and provide a cross-cutting control summary.

References

1. IMIT 6.28 (communications/network security)
2. IMIT 5.08 (network-to-network trust boundary)
3. IMIT 6.13 and ISCF intent (segregation and classification)
4. BC Gov application and deployment security standards
5. Related agents: ci-cd-pipeline, security-architect, bc-gov-network-architect, zero-trust-architect, observability

Standard output set

Suggested filenames:

• report/-deployment-cicd-analysis-v1.md
• report/-deployment-cicd-analysis-v1.pdf
• docs/-executive-summary-v1.md
• docs/-adm-brief-v1.md
• docs/-client-report-and-process-guide-v1.md
• docs/process-log/YYYY-MM-DD-.md

Control matrix template

Control ID	Control Domain	Current State	Evidence	Gap	Recommended Action	Owner	Target Date
CM-01	Release Integrity
CM-02	Quality Gates
CM-03	Secrets Lifecycle
CM-04	Governance Approval
CM-05	Audit Retention

---

BC_GOV_DEPLOYMENT_CICD_ANALYST_KNOWLEDGE