ci-cd-pipeline

Automate CI/CD quality gates in GitHub Actions workflows with security scanners.

Updated Mar 28, 2026

Search Tags:#github-actions #ci-cd #semgrep #trivy #gitleaks #pipeline-security #osv-scanner

Ready to run

npx skills add https://github.com/mechemsi/claude-template --skill ci-cd-pipeline-mechemsi

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ci-cd-pipeline
Source: https://github.com/mechemsi/claude-template/tree/main/skills/ci-cd-pipeline
Command: npx skills add https://github.com/mechemsi/claude-template --skill ci-cd-pipeline-mechemsi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Design processes and pipelines that ensure CI/CD catches security and quality gaps in AI-generated code; without robust gates, secrets slip through, tests miss flaky behavior, and deployments ship with unresolved issues.

Core Features & Use Cases

Establish and audit CI/CD gates across workflows (gitleaks, semgrep, trivy, osv-scanner) to block insecure code.
Provide guidance on what should fail the build vs warn, and standardize tooling across repositories.
Apply the gates when designing new pipelines, auditing existing ones, or reviewing PRs that involve AI-generated changes.

Quick Start

Create or update a GitHub Actions workflow to incorporate the recommended gates and tooling described above.

Frequently Asked Questions about ci-cd-pipeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I add security gates to GitHub Actions workflows for AI-generated code?▼

Security gates in GitHub Actions block insecure AI-generated code by codifying tool checks using gitleaks, semgrep, trivy, and osv-scanner, enforcing build failures when secrets or vulnerabilities slip through pull requests.

What is the best way to prevent secrets from leaking in CI/CD pipelines?▼

The best way to prevent secrets from leaking in CI/CD pipelines is enforcing automated quality gates with gitleaks to scan pull requests, ensuring workflows fail builds immediately when hardcoded secrets are detected in AI-generated code.

Which tools should I use to scan code vulnerabilities in GitHub Actions?▼

To scan code vulnerabilities in GitHub Actions, use semgrep for static analysis, trivy for container scanning, gitleaks for secret detection, and osv-scanner to identify known vulnerabilities in open source dependencies.

Can I standardize pipeline security tooling across multiple repositories?▼

You can standardize pipeline security tooling across multiple repositories by codifying governance rules and tool recommendations into a repeatable CI/CD pipeline standard that dictates what should fail builds versus issue warnings.

When should a CI/CD pipeline fail the build versus issue a warning?▼

A CI/CD pipeline should fail the build when critical security gaps like leaked secrets or severe vulnerabilities are detected, while issuing warnings for lower-risk code quality issues to maintain reliable deployments of AI-generated code.