What problem does it solve? CI/CD configuration files list steps but never explain the actual process a change goes through. This Skill reads workflow definitions, build files, and release scripts to reconstruct the full lifecycle — what runs on a PR, what gates a merge, how releases are versioned and published, and where artifacts get deployed — in language a new team member or auditor can follow. ## Core Features & Use Cases - Lifecycle Reconstruction: Maps the trigger surface (PR, push, tag, schedule, manual dispatch) and traces each stage from build through testing, quality gates, release, and deployment, following reusable-workflow chains and shell scripts to their leaves. - Pipeline Hygiene Audit: Flags risks like unpinned third-party actions, over-broad credentials, pull_request_target misuse, missing test gates on the release path, and secrets that could leak into logs. - Evidence-Backed Findings: Every claim cites the workflow or script lines it was read from, with declared facts distinguished from inferences and absences reported as findings. - Use Case: Ask "what happens when I push a tag starting with v?" and receive a narrative of the release flow — version bumping, changelog, artifact publishing to npm or other registries, signing, and deployment channels — plus any hygiene concerns. ## Quick Start Ask the AI to run the cicd-scan skill on this repository and explain how the project is built, tested, and released.
