# AI Pipeline

> Generates, evolves, and validates CI/CD pipelines for GitHub Actions or Azure Pipelines, enforcing SHA pinning, timeouts, secret handling, and concurrency policy. Trigger for 'set up CI/CD', 'add a deployment pipeline', 'is this workflow secure', 'check workflow policy', 'add a security scan to CI'. Not for running pipelines; that is the CI system's job. Not for governance audits; use /ai-governance instead.

- Skill: `arcasilesgroup/ai-pipeline` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add arcasilesgroup/ai-pipeline`
- Raw SKILL.md: https://api.skillmd.com/api/skills/arcasilesgroup/ai-pipeline/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: arcasilesgroup (https://skillmd.com/u/arcasilesgroup)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/arcasilesgroup/ai-pipeline

---


# CI/CD Pipeline

Router skill for CI/CD pipeline generation. Dispatches to a handler by sub-command.

```
/ai-pipeline generate --provider github   # scaffold a new GHA workflow
/ai-pipeline evolve --provider azure      # add patterns to an existing pipeline
/ai-pipeline validate                     # SHA pinning, timeouts, secret handling
```

## Routing

| Sub-command | Handler | Purpose |
|-------------|---------|---------|
| `generate` (default) | `handlers/generate.md` | Create new pipeline from project analysis |
| `evolve` | `handlers/evolve.md` | Add advanced patterns to an existing pipeline |
| `validate` | `handlers/validate.md` | Check pipeline compliance (SHA pins, timeouts, concurrency) |

Default (no sub-command): `generate`.

## Process

**Step 0 — load contexts**: read `.ai-engineering/manifest.yml` `providers.stacks`; load `.ai-engineering/overrides/<stack>/conventions.md` for each stack and `.ai-engineering/overrides/_shared/conventions.md`; load `.ai-engineering/team/*.md` for team conventions. Then dispatch to the handler for the resolved sub-command.

## Shared Rules

- **SHA pinning**: all third-party actions use SHA pins. First-party (`actions/*`) may use major tags.
- **No `*` versions**: explicit version constraints always.
- **OIDC auth**: prefer OIDC over long-lived secrets.
- **Timeouts**: every job must have `timeout-minutes`.
- **Concurrency**: group by branch to prevent parallel runs.

## Examples

User: "set up CI/CD for this Python project on GitHub Actions" → `/ai-pipeline generate --provider github`. Reads `providers.stacks` from `manifest.yml`, scaffolds `.github/workflows/ci.yml` with SHA-pinned actions, OIDC auth, timeouts, and concurrency groups; runs `actionlint` to verify.

## Integration

Reads: `providers.stacks` from `.ai-engineering/manifest.yml`. Calls: `actionlint` (GHA), `scripts/check_workflow_policy.py`. See also: `/ai-governance` (validates governance process around pipelines), `/ai-security` (CVE/SBOM scanning).

$ARGUMENTS