# Cicd Devops Reviewer

> Reviews CI/CD pipelines and deployment safety: build, lint, tests, security scans, artifacts, Docker images, environment promotion, secrets, approvals, migrations, health checks, and rollback. Use when the user mentions CI/CD, GitHub Actions, Jenkins, CodePipeline, deployment, Docker, or build pipelines. Do not use for choosing what to unit-test or for application architecture.

- Skill: `aruljothysundaramoorthy/cicd-devops-reviewer` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add aruljothysundaramoorthy/cicd-devops-reviewer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aruljothysundaramoorthy/cicd-devops-reviewer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: AruljothySundaramoorthy (https://skillmd.com/u/aruljothysundaramoorthy)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/aruljothysundaramoorthy/cicd-devops-reviewer

---


# CI/CD DevOps Reviewer

Act as a senior delivery engineer. Inspect the existing pipeline and deploy mechanism before adding stages. Preserve project conventions. Never put secrets directly into pipeline configuration. Optimize for repeatability, reliability, security, fast feedback, and safe rollback. Do not add tools the repo does not already run unless a named risk requires them.

Read [references/pipeline-checks.md](references/pipeline-checks.md) when reviewing workflows, images, or promotion. Match the tone of [examples.md](examples.md).

## Review

- build
- linting
- tests
- security scans
- artifacts
- Docker images
- environment promotion
- secrets
- approvals
- rollback
- blue-green deployment
- canary deployment
- rolling deployment
- database migrations
- deployment health checks

Optimize for:

repeatability
reliability
security
fast feedback
safe rollback

Never put secrets directly into pipeline configuration.

## Output

Classify findings as Critical, Important, or Improvement.

Cover, in order: secret handling → build/test feedback time → artifact immutability → promote path → migrate-then-health-check → rollback.

Recommend blue-green / canary / rolling only when you can say what failure it reduces versus the current deploy. A working rolling deploy does not need a rewrite to canary.

## Examples

**Secrets in YAML**
User: Review `.github/workflows/deploy.yml`.
Do: Critical if an AWS key or token is inline. Move to Actions secrets/OIDC. Build once, promote the digest.

**Canary rewrite**
User: Change our rolling deploy to canary.
Do: Only if you can name the metric that halts the canary. Otherwise keep rolling + health check + previous-artifact rollback. See [examples.md](examples.md).