ci-engineer

name	ci-engineer
description	Chords CI/CD workflow guidance. Use for authoring or reviewing GitHub Actions workflows under `.github/workflows`: Ubuntu/Windows builds, license-report and version-increment guards, Gradle wrapper validation, and artifact publishing.

CI Engineering

Use this skill for GitHub Actions workflow work under .github/workflows/. Publishing to Maven repositories happens automatically on master, but changes to the publishing pipeline and its credentials remain human-reviewed; this skill authors and reviews workflow definitions, it does not trigger them.

Scope

• .github/workflows/build-on-ubuntu.yml: JDK 11 build on every push.
• .github/workflows/build-on-windows.yml: Windows build on pull requests.
• .github/workflows/ensure-reports-updated.yml: guard that dependencies.md / pom.xml (or version.gradle.kts) changed in the PR, via config/scripts/ensure-reports-updated.sh.
• .github/workflows/increment-guard.yml: the checkVersionIncrement guard.
• .github/workflows/gradle-wrapper-validation.yml: wrapper JAR integrity.
• .github/workflows/publish.yml: publishing from master, including GPG decryption of credentials from .github/keys/.
• Workflow triggers, branch filters, job/step wiring, JDK setup, caching, working directories, and secret references by name.

For secret handling and supply-chain safety, also use .agents/skills/security-reviewer/SKILL.md. For the Gradle tasks the workflows invoke, use .agents/skills/build-engineer/SKILL.md.

Rules

• Do not weaken the guards that gate merges: the version-increment check, the license-report check, wrapper validation, and the build steps.
• Preserve existing triggers, branch filters, JDK versions, and working directories unless the task explicitly asks to change them. Note that the repository checkout must initialize the config submodule where scripts from it are used.
• Reference secrets by name through secrets.*. Never inline secret values, tokens, or credentials into a workflow.
• Do not add steps that publish artifacts or rotate credentials as routine changes. Describe the required human action instead.
• Keep in mind the two-toolchain layout: root builds need JDK 11; any step building codegen/plugins directly needs JDK 17 and runs from codegen/plugins/.

Verification

Workflows run in GitHub Actions, not locally. Verify changes by static review:

• Confirm referenced Gradle tasks, module paths, scripts, and working directories exist and match the owning build.gradle.kts, config/scripts, and README files.
• Confirm secret names, environment variables, branch filters, and job dependencies match the intended trigger and the rest of the pipeline.
• Confirm that jobs using scripts from the config/ submodule configure actions/checkout with submodule initialization.
• Validate YAML structure and the versions of referenced actions.

State clearly in the final response that full validation happens in CI.

Follow the git-history and safety policy in AGENTS.md.