菜单
Designs and hardens CI/CD pipelines across GitHub Actions, GitLab CI, Jenkins, and CircleCI — caching, matrix builds, least-privilege tokens, pinned actions, and OIDC instead of long-lived secrets. Triggers when writing or fixing a pipeline/workflow file, speeding up CI, or securing a build.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/Sir-chawakorn/sanook-cli --skill cicd-pipeline-author命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Gets machine-parseable JSON out of an LLM reliably — prefer provider-enforced grammar (OpenAI `response_format:{type:"json_schema",strict:true}`, Anthropic tool-calling / `tool_choice:{type:"tool"}`, Gemini `responseSchema`) over a "respond in JSON" prompt, define the contract once as a Pydantic/Zod model and validate every response (never trust the string), use constrained decoding / grammars for open weights (Outlines, llguidance, llama.cpp GBNF, vLLM `guided_json`), keep schemas SHALLOW with required fields + enums + `additionalProperties:false`, and build a repair-and-retry loop that handles refusals, `length`/`max_tokens` truncation, and streaming partial JSON (`partial-json-parser`). Schema-guided generation eliminates parse-error retries; validate-and-repair is the backstop, not the primary mechanism.
Builds production data grids that stay fast and accessible at 10k–1M+ rows — decide server-side vs client-side sort/filter/paginate by the dataset-fits-in-memory test (client only under ~10k rows, otherwise push to the API and treat the table as a controlled view of server state), ROW-VIRTUALIZE with TanStack Virtual or react-window so only the visible window mounts (fixed estimateSize, overscan 5–10, measureElement for dynamic rows, contain:strict, and a real scroll container — never table-layout:auto over thousands of rows), build the headless logic with TanStack Table v8 (or AG Grid when you need pinning/grouping/enterprise out of the box), add column resize/reorder/pin, inline edit with optimistic update + rollback on error, row selection with a stable rowId, full keyboard nav with roving tabindex over an ARIA grid (role=grid/row/gridcell, aria-sort, aria-rowcount/aria-rowindex so virtualization stays announced), position:sticky headers, streaming CSV export that doesn't block the main thread, and explici
Builds semantic/vector search — pick an embedding model + dimensionality (and whether to truncate Matryoshka dims) and the matching distance metric (cosine/dot/L2, normalize to unit length so cosine == dot and IP is correct), an ANN index with the recall/latency/memory tradeoff understood (HNSW M/efConstruction/efSearch for low-latency RAM-resident; IVF-PQ nlist/nprobe/PQ for billion-scale compressed; flat/exact for <100k) in pgvector/Qdrant/Milvus/FAISS/Pinecone, chunking + overlap + per-chunk metadata for filtering, HYBRID retrieval fusing BM25 + dense by Reciprocal Rank Fusion (RRF, k≈60) not score addition, a cross-encoder/Cohere reranker over the top-50→k, correct pre-filter-vs-ANN interaction (filterable HNSW, not post-filter that starves k), and offline eval with recall@k / nDCG@10 / MRR against a labeled qrels set. Quantize (scalar/PQ) only after measuring recall loss; tune efSearch/nprobe to a recall target, not a guess.
基于 SOC 职业分类
正在显示 SKILL.md
| name | cicd-pipeline-author |
| description | Designs and hardens CI/CD pipelines across GitHub Actions, GitLab CI, Jenkins, and CircleCI — caching, matrix builds, least-privilege tokens, pinned actions, and OIDC instead of long-lived secrets. Triggers when writing or fixing a pipeline/workflow file, speeding up CI, or securing a build. |
| when_to_use | เขียน/แก้ .github/workflows, .gitlab-ci.yml, Jenkinsfile; CI ช้า/แพง; ต้อง harden pipeline หรือเปลี่ยนไป OIDC |
Use this skill when the task touches a pipeline definition file or its performance/security:
.github/workflows/*.yml, .gitlab-ci.yml, Jenkinsfile, or .circleci/config.yml.Skip if the change is a one-line tweak whose diff you can state in a sentence (bump a runner image tag, fix a typo in a step name) — just make it.
Detect platform and read the existing pipeline first. Match the file: .github/workflows/* → Actions, .gitlab-ci.yml → GitLab, Jenkinsfile → Jenkins, .circleci/config.yml → CircleCI. Never rewrite blind — read the current file, note language/build tool, where secrets are consumed, and which steps dominate runtime.
Lay out stages as a DAG, not a straight line. Target order: lint+typecheck → build → test → security-scan → deploy (gated). Run independent stages in parallel; only serialize on real data dependencies. In Actions use needs:; in GitLab stage: + needs: for out-of-order DAG; in CircleCI requires: under workflows.
Cache the dependency layer, key it on the lockfile. Cache key = hash of the lockfile, with a restore-key fallback for partial hits. Cache the package dir, not node_modules-style install output that must stay in sync with the runner.
actions/cache with key: deps-${{ runner.os }}-${{ hashFiles('**/lock*') }} and restore-keys: deps-${{ runner.os }}-. For common ecosystems prefer the built-in cache (e.g. setup-* with cache: input) which keys the lockfile for you.cache: { key: { files: [lockfile] }, paths: [...], policy: pull-push }; set policy: pull on jobs that only read.Add a matrix only where it earns parallelism. Fan out across versions/OS that you actually support. Set fail-fast: false when you need the full failure map (e.g. compatibility testing); leave it true (default) to abort early and save minutes on normal PR runs. Shard a large test suite across N parallel jobs and merge results.
Pin third-party actions/images by full commit SHA, not a tag. Tags (@v4) are mutable and a supply-chain hole. Pin uses: owner/action@<40-char-sha> # v4.1.2 and keep the version in a trailing comment so a bot can bump it. Pin container/runner images by digest where the platform allows. First-party actions/* may use a major tag if your policy permits, but SHA is the safe default.
Scope token permissions to least privilege. In Actions, set top-level permissions: { contents: read } (default-deny everything else) and widen per-job only for what that job needs (e.g. id-token: write for OIDC, packages: write to publish). In GitLab, prefer job tokens with limited scope over project access tokens. Never give a test job write access.
Replace static cloud secrets with OIDC. Stop storing long-lived AWS_*/GCP_*/AZURE_* keys. Have the pipeline mint a short-lived token via the provider's federated identity:
permissions: id-token: write (Actions) or the platform's OIDC equivalent.repo:*).Factor shared logic into reusable workflows/templates. Actions: reusable workflow called via uses: ./.github/workflows/x.yml or a composite action. GitLab: include: + extends: + !reference. CircleCI: orbs/commands. Jenkins: shared library. One source of truth beats copy-pasted YAML across services.
Make failures fast and required. Put cheap checks (lint, typecheck) before expensive ones so a bad PR fails in seconds. Add timeout-minutes to every job so a hung step can't burn an hour. Wire the gating jobs into branch protection / required status checks so deploy literally cannot run on a red build. Gate deploy on a protected environment with manual approval for prod.
Validate locally and report the diff. Lint the file, dry-run if possible (see Verify), then report before/after wall-clock and estimated runner-minutes, plus the security delta (secrets removed, permissions narrowed, actions pinned). A pipeline change without a measured result is unfinished.
permissions block at top level silently kills the whole-workflow grant. The moment you add any permissions: key, every unlisted scope becomes none. A push/comment step that worked before will now 403. Add back exactly what each job needs at job level.Error: Not authorized to perform sts:AssumeRoleWithWebIdentity / audience mismatch. The cloud-side trust condition doesn't match the token's sub/aud. Check the exact subject string format (it differs for branch vs tag vs environment vs pull_request) and that the audience matches what the auth step requests.fail-fast cancels sibling matrix jobs and you lose the failure you needed. For compatibility/flake debugging set fail-fast: false; for normal PRs keep it on to save minutes — they're opposite goals, pick deliberately.secrets: inherit or map each one explicitly.pull_request from a fork can't read secrets / OIDC. That's by design (untrusted code). Don't "fix" it by switching to pull_request_target with checkout of the PR head — that's a known privilege-escalation footgun. Run untrusted PR builds without secrets.timeout-minutes → a hung network call burns the full default timeout (often 6h) of paid minutes. Set an explicit per-job timeout always.actionlint (catches expression and context errors a YAML linter misses). GitLab → CI Lint API/UI. CircleCI → circleci config validate. Jenkins → jenkins-cli declarative-linter. Any platform → a plain YAML linter as a floor.act for Actions) for fast iterate-on-failure before pushing; if the job has external/cloud deps that can't run locally, push to a throwaway branch and read the live run.secrets.* for cloud creds remaining (OIDC instead); top-level permissions is read-only with per-job widening; every third-party action pinned to a full SHA; every job has timeout-minutes; deploy gated by required checks + protected environment.