ci-tooling

name	ci-tooling
version	2.3
last_updated	2026-08-09
id	ci-tooling
one_line_purpose	Apply CI policy for SHA pinning, pre-commit, and Renovate tooling.
entry_point	docs/skills/ci-tooling/SKILL.md
category	ci-ops
mcp_compliance_level	partial
optimization_status	draft
status	active
dependencies	[]
tags	["ci","workflows","github-actions"]
description	CI policy and tooling — SHA pinning, pre-commit guards, Renovate digest tracking, and workflow config. Use when editing .github/workflows/ files.
metadata	{"type":"reference","context7-sources":["/websites/github_en_actions","/pre-commit/pre-commit.com","/sigstore/cosign","/containers/skopeo","/containers/buildah","/oras-project/oras","/anchore/syft","/anchore/grype","/aquasecurity/trivy","/renovatebot/renovate","/rhysd/actionlint"]}

CI tooling

Split notice (2026-06-24): Incident-log / gotcha entries moved to ci-pitfalls.md. Shell script authoring and testability patterns moved to shell-scripts.md. This file retains CI policy and configuration.

When to Use

• Editing .github/workflows/ or .pre-commit-config.yaml
• Debugging pre-commit failures around floating tags, auto-fix hooks, or schema validation
• Updating shared CI policy that propagates across factory repos
• Auditing whether a workflow change belongs in repo-local CI or projectbluefin/actions

When NOT to Use

• Debugging a silent CI failure or startup_failure with no output → ci-pitfalls.md
• Writing or testing shell scripts under system_files/ → shell-scripts.md
• User-facing image content changes in system_files/ or Containerfile
• Release promotion logic and stream semantics (use release-promotion.md)
• Issue lifecycle or queue automation (use label-workflow.md or bonedigger skills)
• One-off PR status checks with no reusable CI pattern to capture

---

Core Process

1. Read the workflow or pre-commit hook before describing it; do not rely on memory.
2. Classify the ref or tool involved: external action, internal projectbluefin/* reusable, schema validator, or local hook.
3. For workflow steps that call repo-local entrypoints such as just check, read the full dependency chain and install every clean-runner dependency in that workflow before the step.
4. Keep just check hermetic. A check that reaches a third-party host belongs in its own workflow with a path filter and a cron, not in the repo-wide gate — otherwise someone else's outage reddens every open PR and the merge queue, and offline contributors cannot commit. Enforce this over the whole recipe closure — header, body, and every recipe depends on — not the header line alone; does this and carries mutation tests proving it. Keep workflow/job permissions minimal ( unless more is required); GitHub Actions supports step-level and workflow/job , source: .