ci-cd

Diagnose and safely modify GitHub Actions and GitLab CI pipelines with evidence-based review.

Updated May 11, 2026

Search Tags:#devops #deployment #rollback #github actions #ci-cd #gitlab ci #pipeline security

One-click install

npx skills add https://github.com/cloudofgeorge/AI-hands-Engineer --skill ci-cd-cloudofgeorge

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: ci-cd
Source: https://github.com/cloudofgeorge/AI-hands-Engineer/tree/main/skills/engineering/tools/ci-cd
Command: npx skills add https://github.com/cloudofgeorge/AI-hands-Engineer --skill ci-cd-cloudofgeorge

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? CI/CD pipelines control production deployments, secrets, and artifacts, so a careless fix or retry can expose credentials, run untrusted code, or ship the wrong build. This Skill enforces an evidence-first, read-only triage process before any pipeline change, re-run, approval, or rollback. ## Core Features & Use Cases - Read-only failure triage: Identify the first causal error by inspecting the failing revision, job logs, trigger, actor, runner, and deployment history before touching anything. - Secure workflow review: Apply least-privilege token permissions, full-length SHA pinning, OIDC federation, and fork/untrusted-code isolation for GitHub Actions and GitLab CI. - Approval-gated changes: Require an explicit approval gate covering target, evidence, risk, change, verification, and recovery before deployments, promotions, or rollbacks. - Use Case: A production deployment job fails after a pull request merge. Use this Skill to compare the failing revision against the last known-good run, verify the artifact digest and OIDC identity, then present an approval-gated rollback plan instead of blindly re-running the job. ## Quick Start Ask the agent to triage the failed GitHub Actions run for the current repository and propose a safe fix without changing any workflow yet.

Frequently Asked Questions about ci-cd

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I safely debug a failed GitHub Actions workflow?▼

Start read-only: inspect the workflow file at the failing commit, the job summary, redacted logs, trigger event, actor, and runner identity. Compare against the last known-good revision to isolate whether the cause is configuration, source, dependency, secrets, or runner related.

How do I secure GitHub Actions against untrusted pull request code?▼

Never combine privileged triggers like pull_request_target or workflow_run with checkout of untrusted PR code. Set explicit least-privilege permissions, pin third-party actions to full-length commit SHAs, and separate untrusted builds from privileged deployment jobs.

Does this Skill support GitLab CI as well as GitHub Actions?▼

Yes, it covers both platforms, including GitLab job rules evaluation, protected variables, runner tags, and fork pipeline trust boundaries. The syntax and trust controls differ, so the Skill first identifies which platform and runner execute the pipeline.

When is it safe to retry a failed CI job?▼

Retry only when the trust boundary is unchanged and the job cannot expose secrets, publish artifacts, deploy, or execute unreviewed fork code. A retry of a privileged or production job requires understanding its identity and inputs first.

What approvals are needed before changing a production deployment pipeline?▼

Present the target revision and artifact digest, causal evidence, risk assessment, exact change, verification plan, and rollback path, then obtain explicit user or operator confirmation. Never bypass tests, branch protection, or deployment gates without a time-boxed, owned exception.