skills.rest
Arafly
AraflyCOMMUNITY
Explore all skills by this author →
𝕏@MolokofiXGitHub

cicd-pipeline-review

Audit CI/CD pipeline estates for triggers, runners, secrets, and deployment paths.

1|Updated Jul 17, 2026
Search Tags:#github actions#jenkins#cicd#supply chain#release engineering#deployment security#pipeline review
One-click install
npx skills add https://github.com/Arafly/sre-playbooks --skill cicd-pipeline-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cicd-pipeline-review
Source: https://github.com/Arafly/sre-playbooks/tree/main/cicd-pipeline-review
Command: npx skills add https://github.com/Arafly/sre-playbooks --skill cicd-pipeline-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you safely understand, audit, and change unfamiliar CI/CD pipeline estates without accidentally exposing secrets, breaking deployments, or modifying protected release paths.

Core Features & Use Cases

  • Pipeline Mapping: Identify CI/CD platforms, triggers, stages, runners, environments, and promotion paths across systems like GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines, Buildkite, and Tekton.
  • Risk Review: Surface supply-chain and delivery risks such as unpinned actions, broad permissions, fork-PR secret exposure, missing approval gates, self-hosted runner exposure, and unclear rollback paths.
  • Safe Change Planning: Define validation steps, off-production test loops, and design-note requirements before making non-trivial pipeline changes.
  • Use Case: If you inherited a deployment pipeline and need to know who can ship to production, what secrets it can access, and how to harden it safely, this Skill produces a defensible review and action plan.

Quick Start

Ask the assistant to review your CI/CD pipelines, explain how they deploy to production, and identify the highest-risk changes you can make safely.

Frequently Asked Questions about cicd-pipeline-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit an inherited CI/CD pipeline for deployment security risks?▼

To audit a CI/CD pipeline, map all triggers, runners, secrets, and deployment paths. Validate permissions, approval gates, rollback paths, and off-production testing to surface supply-chain risks like unpinned actions or broad access before making changes.

What supply chain risks should I look for in GitHub Actions and Jenkins pipelines?▼

Common CI/CD supply chain risks include unpinned actions, broad permissions, fork-PR secret exposure, missing approval gates, self-hosted runner exposure, and unclear rollback paths across platforms like GitHub Actions and Jenkins.

How do I safely modify production promotion controls in an unfamiliar deployment pipeline?▼

Safely modifying production promotion controls requires defining validation steps, off-production test loops, and design-note requirements first. Review the pipeline's permissions and rollback paths to ensure non-trivial changes do not break protected release paths.

Does CI/CD pipeline review work with GitLab CI, CircleCI, Azure Pipelines, Buildkite, and Tekton?▼

CI/CD pipeline review supports mapping triggers, stages, runners, and environments across common platforms including GitLab CI, CircleCI, Azure Pipelines, Buildkite, and Tekton to identify delivery risks and plan safe changes.

What is the best way to identify who can ship to production and what secrets a pipeline can access?▼

The best way to identify who can ship to production is mapping the pipeline estate's promotion paths, approval gates, and secret access. This produces a defensible review and action plan to harden deployment security safely.

Related Skills

Explore More Software Engineering Skills→
thesammykinsthesammykins

cicd-security

Harden CI/CD pipelines with secret management, runner isolation, and artifact verification.

Community
Advanced
tacogipstacogips

secure-github-action

Pin GitHub Actions to commit SHAs and enforce minimal permissions.

Community
Advanced
ils15ils15
10

security-audit-pro

Audit codebases for vulnerabilities, dependencies, container security, SBOM, PII, and compliance.

Community
Advanced
woohyun212woohyun212
21

devsecops-pipeline

Assess CI/CD pipeline security maturity and generate workflow files with security gates.

Community
Advanced