| name | ci-cd-and-automation |
| description | Use when designing or changing build, test or deployment automation that needs explicit safety, permissions and verification. |
CI/CD and Automation
When to use
Use this skill when modifying pipelines, build automation, release jobs, deployment gates or other automation that can change delivery behaviour.
Objective
Keep automation safe, observable and least-privilege while still reducing manual effort and release risk.
Procedure
- Identify the pipeline stage and purpose.
- List required inputs, secrets, permissions and outputs.
- Add or preserve safety checks before the risky step runs.
- Keep build, test and deploy responsibilities separated when practical.
- Add failure reporting that is actionable and easy to trace.
- Verify the pipeline with the narrowest useful run.
Rules
- Do not echo secrets in logs.
- Do not widen permissions when a narrower path works.
- Do not bypass quality gates to make the pipeline pass.
- Do not make deploy steps irreversible without an explicit reason.
Example
When adding a validation workflow, keep read permissions by default, pin or justify third-party actions, separate test and deploy jobs, and make failures actionable. A safe automation change should show what runs, what credentials it receives, how it reports failure and how maintainers can rerun or roll back the change.
References
Verification
