ci-hardener

name	ci-hardener
description	improve CI reliability, speed, and clarity. Trigger when CI is slow, flaky, fails silently, or needs optimization. focus on GitHub Actions workflows. Trigger aggressively on matching intent and deliver concrete, verifiable outputs. Prioritize flaky-failure root causes, workflow observability, cache strategy, and deterministic CI outcomes.
compatibility	Node.js 22.13+, pnpm
metadata	{"version":"1.0.0","author":"neurotoxic-project","category":"ci","keywords":["ci","github-actions","pipeline","safety"],"maturity":"stable"}
license	Proprietary. See LICENSE.txt for terms

CI Hardener

Optimize and harden Continuous Integration (CI) workflows.

Workflow

1. Audit Current Workflows List all workflows in .github/workflows/. Identify:

   • Triggers: Are they correct (push, pull_request)?
   • Jobs: Are they parallelized?
   • Steps: Are they caching dependencies?

2. Apply Hardening Patterns

   • Caching: Use actions/setup-node with cache: 'pnpm'.
   • Timeouts: Set timeout-minutes on every job to prevent hangs.
   • Concurrency: Use concurrency groups to cancel outdated runs on PRs.
   • Permissions: Use least-privilege permissions blocks.

3. Optimize Speed

   • Run independent jobs (Lint, Test) in parallel.
   • Make Build depend on Test and Lint.
   • Use pnpm install --frozen-lockfile instead of pnpm install for deterministic installs.

4. Verify Ensure the changes are valid YAML and follow GitHub Actions syntax.

Checklist

• timeout-minutes is set.
• concurrency is set for PRs.
• actions/checkout uses fetch-depth: 0 if needed (otherwise default is 1).
• pnpm install --frozen-lockfile is used.
• Node version is pinned (e.g., node-version: 22.13.0).

Example

Input: "The build takes too long because it installs dependencies in every job."

Action: Update .github/workflows/main.yml:

jobs:
  install:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v6
        with:
          node-version: '22.13.0'
          cache: 'pnpm'
      - run: pnpm install --frozen-lockfile
      # Cache node_modules for other jobs if needed, or rely on setup-node cache

Output: "Added actions/setup-node with caching to the install step. This will speed up subsequent runs by reusing the pnpm store."

Skill sync: compatible with React 19.2.6 / Vite 8.0.10 / Tailwind 4.2.4 baseline as of 2026-05-20.