skills.rest
TheViziusGroup
TheViziusGroupOFFICIAL
Explore all skills by this author →
WebsiteGitHub

cicd-field-guide

Advises on CI/CD pipeline design, platform selection, security hardening, and delivery metrics.

1|Updated Aug 10, 2026
Search Tags:#github actions#gitops#cicd#trunk-based development#oidc#supply chain security#dora metrics
One-click install
npx skills add https://github.com/TheViziusGroup/vibe-engineering-skills --skill cicd-field-guide-theviziusgroup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cicd-field-guide
Source: https://github.com/TheViziusGroup/vibe-engineering-skills/tree/main/plugins/devsecops-cicd/skills/cicd-field-guide
Command: npx skills add https://github.com/TheViziusGroup/vibe-engineering-skills --skill cicd-field-guide-theviziusgroup

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Teams struggle to keep CI/CD practices current amid shifting platforms, security requirements, and delivery metrics, often relying on outdated patterns like long-lived secrets, GitFlow, and per-environment rebuilds. ## Core Features & Use Cases - Platform Selection Guidance: Compares GitHub Actions, Azure DevOps, GitLab CI, Bitbucket Pipelines, and Jenkins with honest strengths, weaknesses, and migration deadlines. - Security Hardening: Covers OIDC/workload identity federation, SLSA provenance, Sigstore keyless signing, SBOM generation, and EPSS/KEV-based vulnerability prioritization. - Delivery Strategy: Explains DORA's five-metric model, trunk-based development, GitOps (Argo CD vs Flux), progressive delivery (Argo Rollouts vs Flagger), and monorepo tooling (Turborepo/Nx/Bazel). - Use Case: A platform engineer modernizing an enterprise pipeline uses this guide to migrate CI-to-cloud authentication to OIDC, implement build-once artifact promotion, and roll out canary deployments with automated rollback. ## Quick Start Ask the assistant to review your current CI/CD pipeline setup and recommend improvements based on the 2025-2026 field guide, starting with credential security and DORA metrics.

Frequently Asked Questions about cicd-field-guide

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I choose between GitHub Actions, GitLab CI, and Azure DevOps?▼

GitHub Actions suits cloud-native GitHub-centric teams with its large marketplace and OIDC support. GitLab CI fits all-in-one DevSecOps needs with built-in security scanning. Azure DevOps works best for Microsoft-stack enterprises needing mature approval and deployment-environment models.

How do I replace long-lived cloud secrets in CI pipelines?▼

Use OIDC workload identity federation to issue short-lived tokens per run instead of stored secrets. GitHub Actions uses id-token permissions with azure/login, Azure DevOps offers Workload Identity Federation via service connections, and GitLab uses id_tokens blocks.

Argo CD vs Flux: which GitOps tool should I use?▼

Argo CD wins on developer UX, web UI, SSO/RBAC, and multi-cluster visibility, suiting teams where non-engineers need sync status. Flux is lighter, Kubernetes-native, and fully pull-based, favored by platform teams building reproducible multi-cluster infrastructure.

What is the Bitbucket Pipelines app password deprecation deadline?▼

Bitbucket stopped new app password creation on September 9, 2025, with brownouts starting June 9, 2026 and full removal July 28, 2026. Migrate CI integrations to API tokens with scopes or OIDC using the oidc: true flag.

When should I use GitFlow instead of trunk-based development?▼

Trunk-based development is the evidence-backed default for SaaS and web apps with continuous deployment. GitFlow remains appropriate for versioned software like mobile apps, desktop firmware, or OSS projects with external contributors and formal release cycles.

Does AI code generation improve delivery performance?▼

DORA's 2025 research shows AI correlates with higher throughput but worse delivery stability, acting as an amplifier rather than a fix. Strong version control, small batches, and quality internal platforms determine whether AI adoption helps or hurts.

Related Skills

Explore More Software Engineering Skills→
Hack23Hack23
235

cis-controls

Implement CIS Controls v8 security controls for cloud and on-prem environments.

Official
Intermediate
doanchienthangdevdoanchienthangdev
4

DORA Metrics and DevOps Performance

Calculates Heartland efficiency metrics and generates prioritized recommendations for improving them.

Community
Advanced
devendrapratapsinghdevendrapratapsingh
1

security

Scan code, containers, and infrastructure for security vulnerabilities.

Community
Advanced
devendrapratapsinghdevendrapratapsingh
1

idp-platform-cicd

Design IDP CI/CD workflows, Backstage scaffolding, and golden path templates.

Community
Advanced