skills.rest
greglas75
greglas75COMMUNITY
Explore all skills by this author →
GitHub

ci-audit

Audits CI/CD pipelines across 10 dimensions for speed, cost, reliability, and security.

6|Updated Mar 27, 2026
Search Tags:#devops#ci/cd#caching#github actions#secret scanning#pipeline audit#action pinning
One-click install
npx skills add https://github.com/greglas75/zuvo --skill ci-audit-greglas75
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ci-audit
Source: https://github.com/greglas75/zuvo/tree/main/skills/ci-audit
Command: npx skills add https://github.com/greglas75/zuvo --skill ci-audit-greglas75

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? CI/CD pipelines often waste time and money through missing caches, sequential jobs, unpinned actions, and leaked secrets, and teams lack a structured way to find these issues. This Skill performs a read-only, single-pass audit of pipeline configurations and produces a scored report with prioritized fixes. ## Core Features & Use Cases - 10-dimension scoring (CI1-CI10): Evaluates caching, parallelism, conditional execution, artifacts, secret handling, action pinning, timeouts, Docker optimization, test integration, and pipeline speed, producing a 0-100 score with HEALTHY to CRITICAL grades. - Critical security gates: Automatically fails the audit when hardcoded secrets appear in workflow YAML, unverified third-party actions are used, or no tests run in CI. - Multi-platform support: Full coverage for GitHub Actions, with detection-level support for GitLab CI and CircleCI. - Use Case: After noticing slow builds and rising CI costs, run the audit to discover that dependencies are reinstalled in every job and actions are pinned to @main, then follow the generated optimization roadmap of quick wins and short-term fixes. ## Quick Start Ask the assistant to run a CI audit on this repository's GitHub Actions workflows and report the score with the top findings.

Frequently Asked Questions about ci-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a GitHub Actions workflow for security issues?▼

Run the CI audit, which scans workflow YAML for hardcoded secrets, secrets inlined in run scripts, unpinned or unverified third-party actions, and missing permission declarations. Findings are reported with file and line references and severity levels.

How to speed up a slow CI pipeline?▼

The audit's speed-focused dimensions check dependency and build caching, job parallelism and matrix strategies, path-based trigger filters, and critical path depth. Use the --speed-only switch to evaluate only CI1, CI7, CI9, and CI10.

Does this CI audit support GitLab CI or CircleCI?▼

GitLab CI and CircleCI are supported at detection level, covering dimensions CI1-CI5 and CI7-CI10 with adapted patterns. Action pinning (CI6) is GitHub Actions only and is scored as N/A on other platforms.

What causes a CI audit to fail with a critical gate?▼

Three findings trigger an automatic FAIL regardless of numeric score: any hardcoded secret or secret reaching logs, any unverified or unpinned action from an unknown source, and the absence of tests running in CI.

Can the audit modify my workflow files or trigger builds?▼

No. The audit is strictly read-only and its only write target is the report saved under zuvo/audits/. It never modifies workflow files, runs pipelines, changes secrets, or installs actions.

Related Skills

Explore More Software Engineering Skills→
Trigent-Software-Pvt-LtdTrigent-Software-Pvt-Ltd

standards-audit

Audits a repository's .gitlab-ci.yml pipeline against GitLab CI standards and reports violations with line numbers.

Official
Intermediate
Habitat-ThinkingHabitat-Thinking
44

github-actions-supply-chain

Assess GitHub Actions workflows for supply-chain security weaknesses.

Official
Intermediate
shakhovskiya-createshakhovskiya-create

security-audit

Audit codebases for vulnerabilities, secrets, and misconfigurations across CI/CD workflows.

Community
Advanced
oven-shoven-sh
95.3k

slowest-tests

Find the top-N slowest test files from BuildKite CI runs.

Official
Advanced