Builds secure desktop CI/CD pipelines with signing, SBOM, and release automation.
npx skills add https://github.com/Probably-Group/Dev-AID --skill ci-cd-probably-group
Please help me install this Agent Skill. Skill: ci-cd Source: https://github.com/Probably-Group/Dev-AID/tree/main/.dev-aid/skills/expert/ci-cd Command: npx skills add https://github.com/Probably-Group/Dev-AID --skill ci-cd-probably-group
This Skill helps prevent insecure, unreliable CI/CD pipelines by providing production-grade guidance for desktop app releases, including code signing, notarization, artifact handling, and release automation.
Use case: You’re building a Tauri/Electron desktop app and need a cross-platform pipeline that signs every artifact, notarizes macOS builds, generates SBOM/checksums, and creates a trustworthy GitHub release.
Ask the AI to generate a secure GitHub Actions workflow for a Tauri desktop release pipeline that signs macOS and Windows artifacts, creates SBOM/checksums, and publishes the GitHub release with SLSA provenance.
High-intent search queries and answers about installing and using this skill.
To generate SILVA provenance for GitHub Actions releases, you create workflows that output build attestations, SBOMs, and checksums before deployment. This provides verifiable release metadata ensuring artifact trustworthiness and supply chain security for desktop applications.
Yes, this CI/CD pipeline supports Apple notarization and Windows Authenticode code signing. It safely generates, imports, and manages signing credentials using macOS keychain for notarization and certificate import for Windows targets across cross-platform builds.
The best way to prevent common CI/CD threats in desktop app release automation is by enforcing workflow security guardrails. These include minimum permissions, SHA-pinned actions, secret hygiene, concurrency controls, and anti-hallucination patterns to block CI/CD exploitation paths.
To generate SBOM and checksums for Electron release workflows, you configure the CI/CD pipeline to produce verifiable release outputs. The workflow generates SBOM files and creates checksums before publishing artifacts to ensure trustworthy GitHub releases.
You need secret-safe command patterns for code signing in CI/CD pipelines to prevent credential leakage during the build process. Enforcing secret hygiene alongside minimum permissions and artifact verification ensures signing credentials remain protected against exploitation.
FlukeSupakornConfigure GitHub Actions pipelines to build, test, sign, and publish Tauri apps.
brucebanner010198-commitsGenerates CycloneDX SBOMs and SLSA provenance for released artifacts.
Logos-LiberIdentifies security vulnerabilities in code, dependencies, and container images.
gmliaoAutomate SwiftStateTree end-to-end tests with automatic server management.
