srstomp/ci-cd
plugins/pokayokay/skills/ci-cd/SKILL.md
Use when creating or debugging CI/CD pipelines, implementing deployment strategies (blue-green, canary, rolling), optimizing build times, reviewing pipeline security, or working with GitHub Actions, GitLab CI, CircleCI, Azure DevOps, or Bitbucket Pipelines.
$ install --global
skillsauthnpx skillsauth add srstomp/pokayokay ci-cdInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 27, 2026, 7:04 AM60.5s17 files scanned
SKILL.md
- name:
- ci-cd
- description:
- Use when creating or debugging CI/CD pipelines, implementing deployment strategies (blue-green, canary, rolling), optimizing build times, reviewing pipeline security, or working with GitHub Actions, GitLab CI, CircleCI, Azure DevOps, or Bitbucket Pipelines.
CI/CD Expert
Create, debug, and optimize CI/CD pipelines across platforms.
Platform Selection
| Platform | Best For | Key Strength | |----------|----------|--------------| | GitHub Actions | GitHub repos, open source | Marketplace, native integration | | GitLab CI | GitLab repos, self-hosted | Built-in registry, Auto DevOps | | CircleCI | Complex workflows, speed | Parallelism, orbs | | Azure DevOps | Microsoft/enterprise | Azure integration, YAML templates | | Bitbucket | Atlassian stack | Jira integration, pipes |
Key Principles
- Security first: Never expose secrets in logs, use environment-specific secrets
- Reliability: Idempotent steps, deterministic builds, pinned dependency versions
- Efficiency: Cache aggressively, parallelize independent jobs, skip unchanged paths
- Maintainability: DRY with reusable workflows/templates, clear naming
Quick Start Checklist
- Choose platform based on repository hosting
- Create pipeline with lint → test → build → deploy stages
- Configure secrets and environment variables
- Set up caching for dependencies and build artifacts
- Add deployment strategy (blue-green recommended for production)
- Review security checklist before going live
References
| Reference | Description | |-----------|-------------| | github-actions-basics.md | Workflows, triggers, jobs, steps, services | | github-actions-advanced.md | Reusable workflows, composite actions, security, complete example | | gitlab-ci-basics.md | Pipeline structure, triggers, jobs, caching, artifacts, variables | | gitlab-ci-advanced.md | Templates, includes, rules, Docker-in-Docker, security scanning | | circleci-basics.md | Config structure, executors, jobs, commands, caching, artifacts | | circleci-advanced.md | Workflows, orbs, conditionals, Docker builds, complete example | | azure-devops-basics.md | Pipeline structure, triggers, agents, variables, tasks, caching | | azure-devops-advanced.md | Templates, environments, deployments, conditions, containers | | bitbucket-pipelines-basics.md | Pipeline types, steps, caching, artifacts, variables | | bitbucket-pipelines-advanced.md | Pipes, Docker, YAML anchors, deployments, complete example | | deployment-strategies-blue-green-canary.md | Blue-green and canary deployments with K8s and AWS examples | | deployment-strategies-rolling-flags-rollback.md | Rolling deploys, feature flags, rollback, health checks | | debugging-error-categories.md | Environment, permission, network, resource, timing, cache, Docker errors | | debugging-platform-fixes.md | Platform-specific debugging, common fix patterns, quick reference | | security-checklist.md | Secrets, permissions, supply chain security |
Related Skills
srstomp/worktrees
development
VerifiedTrustedCommunity
Git worktree management for isolated task development
6SKILL.mdUpdated Apr 27, 2026
srstomp/work-session
development
VerifiedTrustedCommunity
Use when starting AI development sessions, resuming interrupted work, managing multi-session projects, or orchestrating work with human checkpoint control (supervised, semi-auto, auto, or unattended modes).
6SKILL.mdUpdated Apr 27, 2026
srstomp/verification-before-completion
testing
VerifiedTrustedCommunity
Use before claiming work is done, fixed, passing, ready to commit, ready to PR, or ready to mark complete. Requires fresh verification evidence and explicit command output before success claims.
6SKILL.mdUpdated Apr 27, 2026
srstomp/testing-strategy
development
VerifiedTrustedCommunity
Use when designing test architecture, building API test suites, validating API contracts, setting up component or E2E testing, managing test data, debugging flaky tests, reviewing coverage strategy, or organizing test files. Covers test pyramid, mocking (MSW), frontend (React Testing Library, Playwright), and CI integration.
6SKILL.mdUpdated Apr 27, 2026