skills.rest
mechemsi
mechemsiCOMMUNITY
Explore all skills by this author →
GitHub

ci-cd-pipeline

Automate CI/CD quality gates in GitHub Actions workflows with security scanners.

Updated Mar 28, 2026
Search Tags:#github-actions#ci-cd#semgrep#trivy#gitleaks#pipeline-security#osv-scanner
One-click install
npx skills add https://github.com/mechemsi/claude-template --skill ci-cd-pipeline-mechemsi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ci-cd-pipeline
Source: https://github.com/mechemsi/claude-template/tree/main/skills/ci-cd-pipeline
Command: npx skills add https://github.com/mechemsi/claude-template --skill ci-cd-pipeline-mechemsi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Design processes and pipelines that ensure CI/CD catches security and quality gaps in AI-generated code; without robust gates, secrets slip through, tests miss flaky behavior, and deployments ship with unresolved issues.

Core Features & Use Cases

  • Establish and audit CI/CD gates across workflows (gitleaks, semgrep, trivy, osv-scanner) to block insecure code.
  • Provide guidance on what should fail the build vs warn, and standardize tooling across repositories.
  • Apply the gates when designing new pipelines, auditing existing ones, or reviewing PRs that involve AI-generated changes.

Quick Start

Create or update a GitHub Actions workflow to incorporate the recommended gates and tooling described above.

Frequently Asked Questions about ci-cd-pipeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add security gates to GitHub Actions workflows for AI-generated code?▼

Security gates in GitHub Actions block insecure AI-generated code by codifying tool checks using gitleaks, semgrep, trivy, and osv-scanner, enforcing build failures when secrets or vulnerabilities slip through pull requests.

What is the best way to prevent secrets from leaking in CI/CD pipelines?▼

The best way to prevent secrets from leaking in CI/CD pipelines is enforcing automated quality gates with gitleaks to scan pull requests, ensuring workflows fail builds immediately when hardcoded secrets are detected in AI-generated code.

Which tools should I use to scan code vulnerabilities in GitHub Actions?▼

To scan code vulnerabilities in GitHub Actions, use semgrep for static analysis, trivy for container scanning, gitleaks for secret detection, and osv-scanner to identify known vulnerabilities in open source dependencies.

Can I standardize pipeline security tooling across multiple repositories?▼

You can standardize pipeline security tooling across multiple repositories by codifying governance rules and tool recommendations into a repeatable CI/CD pipeline standard that dictates what should fail builds versus issue warnings.

When should a CI/CD pipeline fail the build versus issue a warning?▼

A CI/CD pipeline should fail the build when critical security gaps like leaked secrets or severe vulnerabilities are detected, while issuing warnings for lower-risk code quality issues to maintain reliable deployments of AI-generated code.

Related Skills

Explore More Software Engineering Skills→
ArogyaReddyArogyaReddy

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for multi-language CI/CD security scanning.

Community
Advanced
roderikroderik
2

semgrep

Scan codebases with YAML rules to detect security vulnerabilities and quality issues.

Community
Advanced
ozan-fnozan-fn

golang-continuous-integration

Automate Golang CI/CD pipelines with GitHub Actions for testing, linting, and releases.

Community
Advanced
rnavarychrnavarych
14

security-testing

Automate security testing with Snyk, Semgrep, Gitleaks, and OWASP ZAP in CI/CD pipelines.

Community
Advanced