cicd-pipeline

name	cicd-pipeline
version	0.2.10
description	Design and configure CI/CD pipelines with GitHub Actions, GitLab CI, and Forgejo Actions. Use this skill when the user asks to create a new workflow, set up pipeline triggers, configure caching or matrix builds, manage CI secrets, troubleshoot pipeline failures, or compare pipeline platforms — even if they don't say "CI/CD" explicitly. Not for monitoring an existing PR's CI (use git-github-workflow) or executing deployments (use deployment-specific tooling).
category	workflow
license	MIT
metadata	{"author":"opencode","lastUpdated":"2026-07-02"}

CI/CD Pipeline

Design and implement efficient, secure, and reliable CI/CD pipelines.

When to Use

• User asks to set up, optimize, or troubleshoot CI/CD pipelines
• Configuring workflow triggers or managing secrets in pipelines
• Handling pipeline failures or implementing deployment strategies
• Even if they just say "set up CI" or "fix the pipeline"

Platform Comparison

Platform	Config Location	Runner	Secrets
GitHub Actions	.github/workflows/	GitHub-hosted or self-hosted	secrets.* context
GitLab CI	.gitlab-ci.yml	Shared or specific runners	$CI_JOB_VAULT
Forgejo Actions	.forgejo/workflows/	Docker or host	Repository secrets

Pipeline Design Workflow

1. Define triggers — Push, PR, schedule, or manual dispatch. Use paths filters to skip unnecessary runs.
2. Structure jobs — Separate lint, test, build, and deploy into distinct jobs. Use dependencies for ordering.
3. Add caching — Cache dependencies (npm, pip, cargo) between runs. Reduces build times 30-70%.
4. Manage secrets — Never hardcode tokens. Use platform secret stores and rotate regularly.
5. Add security scanning — Run SAST, dependency scanning, and secret detection in CI.
6. Configure notifications — Alert on failures to Slack, Discord, or email.

Common Failure Patterns

Symptom	Likely Cause	Fix
Timeout on checkout	Shallow clone + large repo	Increase fetch-depth or use --depth 1
OOM during test	Too many parallel tests	Limit concurrency or add swap
Flaky test failures	Race conditions or external deps	Quarantine flaky tests, add retries
Secret not found	Wrong environment scope	Verify secret is available in the correct job/environment
Cache not restoring	Cache key mismatch	Use hashFiles() for deterministic keys

Gotchas

• GitHub Actions GITHUB_TOKEN expires after 1 hour — don't use it for long-running workflows.
• GitLab CI rules: and only/except are mutually exclusive — pick one per job.
• Forgejo Actions are compatible with GitHub Actions syntax but may lag behind on new features.
• Matrix builds multiply cost — a 3x3 matrix runs 9 jobs, not 3.
• Artifact retention defaults vary by platform — set explicit retention to avoid storage costs.

Coverage Integration

Generate Coverage Reports

JavaScript/TypeScript (Jest):

{ "collectCoverage": true, "coverageReporters": ["lcov"] }

Python (pytest):

pytest --cov --cov-report=xml:cobertura.xml

Go:

go test -coverprofile=coverage.out ./...

Java (Maven + JaCoCo): Add JaCoCo plugin to pom.xml, then:

mvn test jacoco:report

Upload Coverage to Codacy

bash <(curl -Ls https://coverage.codacy.com/get.sh) report -r <coverage-report-file>

GitHub Actions:

- name: Upload coverage to Codacy
  env:
    CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
  run: bash <(curl -Ls https://coverage.codacy.com/get.sh) report -r coverage.xml

GitLab CI:

upload-coverage:
  stage: test
  script:
    - bash <(curl -Ls https://coverage.codacy.com/get.sh) report -r coverage.xml
  variables:
    CODACY_PROJECT_TOKEN: $CODACY_PROJECT_TOKEN

Multiple reports (monorepos):

bash <(curl -Ls https://coverage.codacy.com/get.sh) report --partial -r report1.xml
bash <(curl -Ls https://coverage.codacy.com/get.sh) report --partial -r report2.xml
bash <(curl -Ls https://coverage.codacy.com/get.sh) final

Key notes:

• Coverage must be uploaded for every push to be useful for PR analysis
• File paths in reports must be relative to repository root
• Set CODACY_PROJECT_TOKEN as a CI/CD secret (from Codacy > Repository Settings > Coverage)

Rationalizations

Rationalization	Reality
"We don't need secrets management, we'll use environment variables"	Environment variables leak in logs, PRs, and error messages. Use secrets managers and rotate keys.
"Caching slows down the pipeline"	Properly configured caching reduces build times by 30-70% and costs.
"We'll add security scanning later"	Security vulnerabilities found in production are 100x more expensive to fix than in CI.

Red Flags

• Hardcoding secrets or tokens in workflow files
• Skipping security scanning in CI for speed
• Not caching dependencies between pipeline runs
• Using actions/checkout@v3 instead of @v4 (missing security fixes)

References

• Performance Checklist - CI/CD optimization patterns, caching strategies, and runner sizing.
• references/deployment-strategies.md - Blue-green, canary, and rolling deployments.
• references/failure-recovery.md - Handling pipeline failures and rollbacks.
• references/security-scanning.md - Integrating security tools into pipelines.

See Also

• git-github-workflow — Full commit-to-merge lifecycle including CI monitoring
• github-pr-sentinel — Specialized PR monitoring with CI failure diagnosis

Voice & Context

• Default: professional + blog
• Reference: voice-profiles skill for definitions and auto-detection.