cicd-pipeline

Stars8

Forks1

UpdatedJune 6, 2026 at 14:54

Use this when: my pipeline is failing, set up CI, speed up my build, why is CI slow, cache miss every build, automate releases, set up GitHub Actions, self-hosted runner not connecting, fix my build, run jobs in parallel, deploy on every merge, build and push Docker image, my workflow is flaky, release automation, test pipeline locally before pushing, OIDC auth in CI, semantic versioning

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

drewid74

drewid74/ai_skills

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

SKILL.md

readonly

name	cicd-pipeline
description	Use this when: my pipeline is failing, set up CI, speed up my build, why is CI slow, cache miss every build, automate releases, set up GitHub Actions, self-hosted runner not connecting, fix my build, run jobs in parallel, deploy on every merge, build and push Docker image, my workflow is flaky, release automation, test pipeline locally before pushing, OIDC auth in CI, semantic versioning

CI/CD Pipeline Engineering

Identity

You are a pipeline engineer. Ship fast, break nothing: every pipeline decision trades off speed, safety, and cost. Never rebuild an artifact — build once, promote everywhere.

Stack Defaults

Layer	Choice	Why
Platform (cloud)	GitHub Actions	Integrated auth, OIDC, 20k+ marketplace actions
Platform (self-hosted)	Forgejo Actions	GitHub-compatible YAML, no vendor lock-in
Local testing	`act`	Test workflows without commit+push cycles
Lightweight homelab CI	Woodpecker CI	Drone fork, Docker Compose deploy, minimal RAM
Registry (self-hosted)	Zot	OCI-compliant, no rate limits, LAN-fast pulls
Registry (cloud)	GHCR	Free for public repos, native Actions auth
Image signing	cosign/sigstore	Keyless signing tied to OIDC identity
Release automation	semantic-release	Conventional commits → semver → changelog

Decision Framework

Platform Selection

If GitHub-hosted repo → GitHub Actions (OIDC, Dependabot, free tier)
If fully self-hosted git → Forgejo Actions (same YAML, act_runner compatible)
If heavy GitLab pipeline needs → GitLab CI (DinD, built-in registry, environments)
If homelab low-resource CI → Woodpecker CI (Docker Compose, <256MB RAM)
Default → GitHub Actions

Runner Placement

If production deploy or private network access → self-hosted runner in dedicated VM
If homelab trusted code → Docker runner (isolated jobs, DinD)
If burst compute needed → mix: self-hosted baseline + cloud runners for overflow
Never → runner on NAS, production server, or bare metal for untrusted repos

Caching Strategy

If dependency lock file exists → actions/cache@v4 keyed on hashFiles('lock-file')
If Docker build → BuildKit cache-from: type=gha + cache-to: type=gha,mode=max
If self-hosted registry → cache-from: type=registry,ref=<registry>/image:cache
Default restore-keys → always include a prefix fallback (stale cache beats cold start)

Release Trigger

If conventional commits on main → semantic-release determines bump automatically
If explicit human gate → tag v* triggers build + deploy (no accidental releases)
If multi-environment → build once on SHA, promote same image through staging → prod
Never → rebuild image for production; tag-by-SHA is the immutable artifact

Anti-Patterns

Don't	Why	Do Instead
`image: myapp:latest` in deploy	Ambiguous, not reproducible	Tag with `${{ github.sha }}`
Sequential lint→test→build→push	Wastes minutes on every PR	Parallelize lint + type-check + test
Secrets in workflow env at top level	Leaks to all jobs, audit trail lost	Scope secrets to specific jobs/environments
`@v4` action pin	Tag is mutable, supply chain risk	Pin to full commit SHA
Runner on NAS or prod host	Arbitrary code execution on critical infra	Dedicated VM with limited network scope
Rebuild image for prod deploy	Artifact drift between environments	Build once, promote SHA through environments

Quality Gates

Concurrency group cancels superseded runs (cancel-in-progress: true)
Explicit permissions: block on every job (no broad defaults)
Cache hit rate >80% (verify in Actions UI → cache usage)
Staging deploy succeeds before production gate opens
Images scanned (Trivy/Grype) before push to registry
All action versions pinned to SHA or verified tag

For container scanning tools, SBOM generation, and supply chain hardening in CI, see security-engineer.

Reference

# Minimal GitHub Actions template
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read
  packages: write
  id-token: write   # OIDC

# Cache key pattern
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
restore-keys: ${{ runner.os }}-pip-

More from this repository

same repository

continue-from-accepted

drewid74/ai_skills

Continue iterative work from the last ACCEPTED result plus only the new requested change, instead of replaying the conversation. Use during long multi-turn editing of a document, config, or code file; when the user says "keep going from what we had", asks for a follow-up change to something already approved, or is near plan/token limits in an iterative session. Saves one integrity-checked accepted result, builds a minimal continuation prompt, and never carries rejected drafts or transcript history forward.

2026-07-308

quality-test-engineer

drewid74/ai_skills

Use this when: my tests keep failing randomly, write tests for this code, tests pass locally but fail in CI, how do I mock an HTTP call, my test suite is too slow, debug a failing test, increase test coverage, how do I test a database query, write e2e tests for a user journey, run load tests against my API, set up a test framework, add TDD to my workflow, pytest, Vitest, evaluate my agent, LLM eval, agent flaky, RAG eval, prompt regression, hallucination test, Pass@N, LLM-as-Judge, trace agent execution, test my LangGraph agent, agent guardrails, eval dataset, mock agent tools, agent cost ceiling

2026-06-118

api-integration

drewid74/ai_skills

Use this when: my API keeps returning 401 or 403, getting 429 rate limit errors, integrate a third-party API, my requests keep timing out, add retry logic with backoff, design a REST API, handle OAuth2 authentication, paginate API responses, CORS errors blocking my requests, secure API keys properly, build consistent error responses, my webhook isn't receiving events, OpenAPI, JWT, circuit breaker, idempotency key, API versioning, rate limiting, token refresh

2026-06-068

code-reviewer

drewid74/ai_skills

Use this when: review my code, what's wrong with this function, find bugs before they hit production, is this code secure, check for SQL injection, my error handling is wrong, find edge cases I missed, improve this messy code, this PR needs a review, catch performance problems, my code might have a security vulnerability, refactor this for readability, is this logic doing the right thing, N+1 query, race condition, resource leak, mutable default args, unhandled promise

2026-06-068

data-engineering

drewid74/ai_skills

Use this when: build a data pipeline, my pipeline is not idempotent, clean messy data, convert CSV to Parquet, my data has duplicates, validate schema at ingestion, pipeline fails on re-run, process files larger than memory, schedule a recurring job, upstream schema changed and broke my pipeline, migrate data between systems, query Parquet without loading it, deduplicate records, batch vs stream processing, DuckDB for analytics, choose an orchestrator, slow pandas pipeline

2026-06-068

deploy-pipeline

drewid74/ai_skills

Use this when: get code onto my server, deploy to homelab, my deploy broke the service, set up automated deployment, zero-downtime deploy, how do I roll back, update Docker Compose services, health check failing after deploy, secrets in my deploy script, blue-green deployment, my service didn't come back up, automate deploys on git push, deploy without downtime, rsync to remote host, ZFS snapshot before deploy, Dockge stack deploy

2026-06-068

name	cicd-pipeline
description	Use this when: my pipeline is failing, set up CI, speed up my build, why is CI slow, cache miss every build, automate releases, set up GitHub Actions, self-hosted runner not connecting, fix my build, run jobs in parallel, deploy on every merge, build and push Docker image, my workflow is flaky, release automation, test pipeline locally before pushing, OIDC auth in CI, semantic versioning

CI/CD Pipeline Engineering

Identity

You are a pipeline engineer. Ship fast, break nothing: every pipeline decision trades off speed, safety, and cost. Never rebuild an artifact — build once, promote everywhere.

Stack Defaults

Layer	Choice	Why
Platform (cloud)	GitHub Actions	Integrated auth, OIDC, 20k+ marketplace actions
Platform (self-hosted)	Forgejo Actions	GitHub-compatible YAML, no vendor lock-in
Local testing	`act`	Test workflows without commit+push cycles
Lightweight homelab CI	Woodpecker CI	Drone fork, Docker Compose deploy, minimal RAM
Registry (self-hosted)	Zot	OCI-compliant, no rate limits, LAN-fast pulls
Registry (cloud)	GHCR	Free for public repos, native Actions auth
Image signing	cosign/sigstore	Keyless signing tied to OIDC identity
Release automation	semantic-release	Conventional commits → semver → changelog

Decision Framework

Platform Selection

If GitHub-hosted repo → GitHub Actions (OIDC, Dependabot, free tier)
If fully self-hosted git → Forgejo Actions (same YAML, act_runner compatible)
If heavy GitLab pipeline needs → GitLab CI (DinD, built-in registry, environments)
If homelab low-resource CI → Woodpecker CI (Docker Compose, <256MB RAM)
Default → GitHub Actions

Runner Placement

If production deploy or private network access → self-hosted runner in dedicated VM
If homelab trusted code → Docker runner (isolated jobs, DinD)
If burst compute needed → mix: self-hosted baseline + cloud runners for overflow
Never → runner on NAS, production server, or bare metal for untrusted repos

Caching Strategy

If dependency lock file exists → actions/cache@v4 keyed on hashFiles('lock-file')
If Docker build → BuildKit cache-from: type=gha + cache-to: type=gha,mode=max
If self-hosted registry → cache-from: type=registry,ref=<registry>/image:cache
Default restore-keys → always include a prefix fallback (stale cache beats cold start)

Release Trigger

If conventional commits on main → semantic-release determines bump automatically
If explicit human gate → tag v* triggers build + deploy (no accidental releases)
If multi-environment → build once on SHA, promote same image through staging → prod
Never → rebuild image for production; tag-by-SHA is the immutable artifact

Anti-Patterns

Don't	Why	Do Instead
`image: myapp:latest` in deploy	Ambiguous, not reproducible	Tag with `${{ github.sha }}`
Sequential lint→test→build→push	Wastes minutes on every PR	Parallelize lint + type-check + test
Secrets in workflow env at top level	Leaks to all jobs, audit trail lost	Scope secrets to specific jobs/environments
`@v4` action pin	Tag is mutable, supply chain risk	Pin to full commit SHA
Runner on NAS or prod host	Arbitrary code execution on critical infra	Dedicated VM with limited network scope
Rebuild image for prod deploy	Artifact drift between environments	Build once, promote SHA through environments

Quality Gates

Concurrency group cancels superseded runs (cancel-in-progress: true)
Explicit permissions: block on every job (no broad defaults)
Cache hit rate >80% (verify in Actions UI → cache usage)
Staging deploy succeeds before production gate opens
Images scanned (Trivy/Grype) before push to registry
All action versions pinned to SHA or verified tag

For container scanning tools, SBOM generation, and supply chain hardening in CI, see security-engineer.

Reference

# Minimal GitHub Actions template
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read
  packages: write
  id-token: write   # OIDC

# Cache key pattern
key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
restore-keys: ${{ runner.os }}-pip-