Stats
Actions
Tags
From cicd-pipelines
CI/CD pipeline design and DevOps automation — use when the user mentions GitHub Actions, GitLab CI, Jenkins, Terraform, infrastructure as code, DevSecOps, ArgoCD, Kubernetes manifests, or pipeline configuration YAML. NOT for automating release workflows or orchestration (use workflow-automation), NOT for Docker containers or Dockerfiles (use docker-containerization), NOT for git branching or commits (use git-workflow).
How this skill is triggered — by the user, by Claude, or both
Slash command
/cicd-pipelines:cicd-pipelinesThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
A unified skill for CI/CD pipeline design, DevOps automation, infrastructure as code, container orchestration, security scanning, and enterprise release management across all major platforms.
references/2025-updates.mdreferences/2fa-enforcement.mdreferences/adr-release-linking.mdreferences/authentication.mdreferences/aws-overview.mdreferences/badge-display.mdreferences/best_practices.mdreferences/branch-coverage.mdreferences/browser-rendering.mdreferences/cicd-github-actions.mdreferences/cloudflare-d1-kv.mdreferences/cloudflare-platform.mdreferences/cloudflare-r2-storage.mdreferences/cloudflare-workers-advanced.mdreferences/cloudflare-workers-apis.mdreferences/cloudflare-workers-basics.mdreferences/dco-implementation.mdreferences/devsecops-basics.mdreferences/devsecops.mdreferences/docker-basics.mdA unified skill for CI/CD pipeline design, DevOps automation, infrastructure as code, container orchestration, security scanning, and enterprise release management across all major platforms.
Use this skill when:
Decision tree:
What are you building?
+-- Node.js/Frontend --> templates/github-actions/node-ci.yml | templates/gitlab-ci/node-ci.yml
+-- Python --> templates/github-actions/python-ci.yml | templates/gitlab-ci/python-ci.yml
+-- Go --> templates/github-actions/go-ci.yml | templates/gitlab-ci/go-ci.yml
+-- Docker Image --> templates/github-actions/docker-build.yml | templates/gitlab-ci/docker-build.yml
+-- Security Scanning --> templates/github-actions/security-scan.yml | templates/gitlab-ci/security-scan.yml
Basic pipeline structure:
# 1. Fast feedback (lint, format) - <1 min
# 2. Unit tests - 1-5 min
# 3. Integration tests - 5-15 min
# 4. Build artifacts
# 5. E2E tests (optional, main branch only) - 15-30 min
# 6. Deploy (with approval gates)
Quick wins checklist:
needs dependenciesnpm ci instead of npm installAnalyze existing pipeline:
# Use the pipeline analyzer script
python3 scripts/pipeline_analyzer.py --platform github --workflow .github/workflows/ci.yml
Essential security checklist:
OIDC Authentication (GitHub Actions to AWS):
permissions:
id-token: write
contents: read
steps:
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789:role/GitHubActionsRole
aws-region: us-east-1
| Domain | Tools & Technologies |
|---|---|
| CI/CD Platforms | GitHub Actions, GitLab CI, Jenkins |
| Infrastructure as Code | Terraform, AWS CDK, CloudFormation, Pulumi |
| Containers | Docker, Kubernetes, Helm, Kustomize |
| GitOps | ArgoCD, Flux |
| Security Scanning | CodeQL, Semgrep, Trivy, Snyk, TruffleHog |
| Cloud Platforms | AWS, Azure, GCP, Cloudflare |
| Release Management | semantic-release, Cosign, SLSA |
Code Commit --> Build --> Test --> Security Scan --> Package
|
Monitor <-- Release Staging <-- Smoke Tests <-- Deploy Dev
|
Manual Approval
|
Deploy Production
App Repo --CI--> Config Repo --ArgoCD--> K8s Cluster
^ |
+----Continuous Sync-----+
references/best_practices.md - Pipeline design patterns, testing strategies, deployment workflowsreferences/optimization.md - Caching strategies, parallelization, build performancereferences/troubleshooting.md - Common issues, debugging, platform-specific problemsreferences/cicd-github-actions.md - GitHub Actions workflows, runners, secretsreferences/security.md - Secrets management, OIDC, supply chain securityreferences/devsecops.md - SAST, DAST, SCA, container scanning guidereferences/devsecops-basics.md - Security best practices, shift-left securityreferences/security-hardening.md - TLS enforcement, input validation, headersreferences/terraform-eks-module.tf - Production EKS cluster Terraformreferences/kubernetes-deployment.yaml - K8s deployment with HPA and ArgoCDreferences/kubernetes-basics.md - Core K8s concepts, pods, servicesreferences/docker-basics.md - Dockerfile best practices, multi-stage buildsreferences/docker-compose.md - Multi-container applicationsreferences/aws-overview.md - AWS fundamentals, IAM, servicesreferences/gcloud-platform.md - GCP overview, gcloud CLIreferences/cloudflare-workers-basics.md - Edge computing, Workersreferences/general.md - Universal enterprise readiness checksreferences/github.md - GitHub-specific enterprise requirementsreferences/openssf-badge-silver.md - Silver badge criteriareferences/openssf-badge-gold.md - Gold badge criteriareferences/signed-releases.md - Artifact and tag signingreferences/reproducible-builds.md - Deterministic build patternsreferences/local-release-workflow.md - Step-by-step release processreferences/workflow-patterns.md - Personal, team, standalone patternsreferences/version-alignment.md - Git tags as SSoTreferences/authentication.md - SSH keys, GitHub CLI auth| Template | Description |
|---|---|
templates/github-actions/node-ci.yml | Complete Node.js CI/CD with security scanning |
templates/github-actions/python-ci.yml | Python pipeline with pytest, coverage, PyPI |
templates/github-actions/go-ci.yml | Go pipeline with multi-platform builds |
templates/github-actions/docker-build.yml | Docker build with multi-platform, signing |
templates/github-actions/security-scan.yml | Comprehensive DevSecOps pipeline |
templates/github-actions/dco-check.yml | DCO sign-off enforcement |
| Template | Description |
|---|---|
templates/gitlab-ci/node-ci.yml | GitLab CI Node.js pipeline |
templates/gitlab-ci/python-ci.yml | Python pipeline with parallel testing |
templates/gitlab-ci/go-ci.yml | Go pipeline with Kubernetes deployment |
templates/gitlab-ci/docker-build.yml | Docker build with DinD, multi-arch |
templates/gitlab-ci/security-scan.yml | DevSecOps with GitLab security templates |
| Template | Description |
|---|---|
templates/releaserc.yml | semantic-release configuration |
templates/package.json | Node.js package for releases |
templates/shareable-config/ | Shareable semantic-release config |
| Template | Description |
|---|---|
templates/GOVERNANCE.md | Project governance documentation |
templates/ARCHITECTURE.md | Technical architecture template |
templates/CODE_OF_CONDUCT.md | Contributor Covenant v2.1 |
templates/SECURITY_AUDIT.md | Security self-audit template |
| Script | Description |
|---|---|
scripts/pipeline_analyzer.py | Analyze workflows for optimization opportunities |
scripts/ci_health.py | Check pipeline status and identify issues |
scripts/validate-devops-skill.sh | Validate DevOps configurations |
| Script | Description |
|---|---|
scripts/verify-badge-criteria.sh | OpenSSF Badge verification |
scripts/check-coverage-threshold.sh | Statement coverage validation |
scripts/check-branch-coverage.sh | Branch coverage analysis |
scripts/verify-signed-tags.sh | Git tag signature verification |
scripts/verify-review-requirements.sh | PR review requirements check |
scripts/check-tls-minimum.sh | TLS 1.2+ enforcement check |
scripts/verify-spdx-headers.sh | SPDX license header verification |
scripts/add-spdx-headers.sh | Add SPDX headers to files |
| Script | Description |
|---|---|
scripts/cloudflare_deploy.py | Cloudflare Worker deployments |
scripts/docker_optimize.py | Dockerfile analysis and optimization |
| Script | Description |
|---|---|
scripts/init_project.sh | Initialize semantic-release for project |
scripts/init_user_config.sh | Create user-level release config |
scripts/create_org_config.sh | Create organization release config |
scripts/generate-adr-notes.mjs | Auto-link ADRs in release notes |
Symptom: Nearly identical workflow files duplicated across repositories Fix: Reusable workflows, Helm charts, Kustomize bases, Terraform modules
Symptom: API keys, passwords committed to git Fix: Secret managers (Vault, AWS SM), sealed secrets, env vars from secure sources
Symptom: No plan for deployment failure, manual intervention required Fix: Blue/green, canary with automated rollback, ArgoCD auto-revert
Symptom: Single 45-minute pipeline rebuilding everything on every commit Fix: Parallel jobs, caching, incremental builds, path-based triggers
Symptom: Dockerfile without USER instruction, pods running privileged Fix: Add USER instruction, set securityContext.runAsNonRoot: true
Symptom: FROM node:latest or image: app:latest in production
Fix: Pin specific versions, use immutable tags with SHA digests
Symptom: Using ${{ github.event.* }} directly in workflow run: blocks
Fix: Use environment variables:
# DANGEROUS - Script injection vulnerability
- run: echo "Title: ${{ github.event.issue.title }}"
# SAFE - Use environment variables
- name: Process issue
env:
TITLE: ${{ github.event.issue.title }}
run: echo "Title: $TITLE"
gh workflow list # List workflows
gh run list --limit 20 # View recent runs
gh run view <run-id> # View specific run
gh run rerun <run-id> --failed # Re-run failed jobs
gh run view <run-id> --log > logs.txt # Download logs
gh workflow run ci.yml # Trigger workflow manually
gl project-pipelines list # View pipelines
gl project-pipeline get <id> # Pipeline status
gl project-pipeline retry <id> # Retry failed jobs
gl project-pipeline cancel <id> # Cancel pipeline
docker build -t myapp . # Build image
docker run -p 3000:3000 myapp # Run container
docker compose up -d # Start multi-container app
docker scout cves myapp # Scan for vulnerabilities
kubectl apply -f deployment.yaml # Apply manifest
kubectl get pods,services # Check status
kubectl logs -f <pod> # Stream logs
kubectl rollout status deployment/app # Check rollout
terraform init # Initialize
terraform plan # Preview changes
terraform apply # Apply changes
terraform state list # List resources
[ ] All secrets in secret management (not in code)
[ ] Resource limits defined for all containers
[ ] Health checks configured (liveness, readiness)
[ ] Horizontal pod autoscaling enabled
[ ] Security contexts set (non-root, read-only)
[ ] Monitoring and alerting configured
[ ] Rollback strategy documented
[ ] Multi-environment support (dev, staging, prod)
[ ] Concurrency controls in CI pipelines
[ ] Remote state backend for Terraform
[ ] Vulnerability scanning in pipeline
[ ] Version pinning for all dependencies
[ ] Branch protection enabled
[ ] Code review required before merge
| Need | Choose |
|---|---|
| Sub-50ms latency globally | Cloudflare Workers |
| Serverless functions (AWS) | AWS Lambda |
| Containerized workloads | AWS ECS/Fargate, GKE, AKS |
| Kubernetes at scale | AWS EKS, Azure AKS, GCP GKE |
| Object storage (zero egress) | Cloudflare R2 |
| Managed SQL | AWS RDS, Azure SQL, Cloud SQL |
| GitHub-integrated CI/CD | GitHub Actions |
| Self-hosted CI/CD | GitLab CI, Jenkins |
| Kubernetes GitOps | ArgoCD, Flux |
| Predictable workloads | Reserved Instances, Savings Plans |
| Fault-tolerant workloads | Spot Instances, Preemptible VMs |
templates/scripts/pipeline_analyzer.pyreferences/troubleshooting.mdreferences/security.md and references/devsecops.mdreferences/general.md checklistscripts/init_project.sh for semantic versioningThis curated skill combines content from the following legacy skills (now part of cicd-pipelines):
npx claudepluginhub viktorbezdek/skillstack --plugin cicd-pipelinesGuides GitHub Actions CI/CD pipelines on architecture, security hardening, performance, deployments, IaC with Terraform, and observability.
Designs modern CI/CD pipelines, GitOps workflows with ArgoCD and Flux, and zero-downtime deployments using Docker, Helm, and Kubernetes.
Sets up production DevOps infrastructure: Docker containerization with Dockerfiles and docker-compose, CI/CD pipelines, Terraform IaC for cloud provisioning, and monitoring. For deploying apps.