CI Pipeline
Trigger phrases: "ci", "pipeline", "github actions", "jenkins", "build pipeline", "pr gate", "pr check", "build fail", "build broke", "ci is failing", "workflow"
Stages (fail-fast — stop if it breaks early)
- Lint / format — style and static analysis
- Build — 0 warnings / 0 errors
- Test — unit + integration, coverage collected
- Quality —
sonarqube-check quality gate
- Security —
dependency-audit + security-scan (where applicable)
- Artifact / packaging — (deployment is separate,
deploy)
Principles
- Deterministic: dependencies pinned, cache keyed correctly; no "it worked on my machine".
- Secret management: CI secret store; NO plaintext secrets in the repo/logs (overlaps with trace scan).
- PR gate: quality gate + tests must pass; a red build is not merged.
- Branch protection: direct push to main is disabled; PR + review required.
When a stage fails
- Fetch the failing job's log first —
gh run view --log-failed, glab ci trace, jenkins-cli console <job>,
whichever this project's host provides — and quote the failing lines: a status icon names which job broke, never why.
Log unreachable (no access, retention expired, the job never started) → report exactly that; never infer the cause.
- Reproduce with the exact command the pipeline runs, copied out of the CI config — same flags, same env, same
versions. Green locally is not a pass: the environment difference is now the defect, so take it to
systematic-debugging.
- A re-run is not a fix. Re-running until it passes hides the cause; re-run only to establish that a failure is
intermittent — and an intermittent failure in this repo's own suite is a bug (
testing), not a retry.
- Say which failures aren't yours. A required check owned by another change, or an external service that was
down, is reported out of scope with the job named — silence about it reads as a clean run.
DoD
- All stages green; PR gates enforced; no secret leakage; build reproducible.
1---2name: ci-pipeline3description: CI pipeline discipline: lint→build→test→quality→security, fail-fast, deterministic build, secret handling, PR gates.4---56# CI Pipeline78<!-- routing-eval reads this line; it lives in the BODY so the always-on skill LISTING stays inside9 Claude Code's budget (1% of the context window) — an overflowing listing gets descriptions10 truncated or dropped, which strips the very keywords a match depends on. -->11Trigger phrases: "ci", "pipeline", "github actions", "jenkins", "build pipeline", "pr gate", "pr check", "build fail", "build broke", "ci is failing", "workflow"1213## Stages (fail-fast — stop if it breaks early)141. **Lint / format** — style and static analysis152. **Build** — 0 warnings / 0 errors163. **Test** — unit + integration, coverage collected174. **Quality** — `sonarqube-check` quality gate185. **Security** — `dependency-audit` + `security-scan` (where applicable)196. **Artifact / packaging** — (deployment is separate, `deploy`)2021## Principles22- **Deterministic:** dependencies pinned, cache keyed correctly; no "it worked on my machine".23- **Secret management:** CI secret store; NO plaintext secrets in the repo/logs (overlaps with trace scan).24- **PR gate:** quality gate + tests must pass; a red build is not merged.25- **Branch protection:** direct push to main is disabled; PR + review required.2627## When a stage fails281. **Fetch the failing job's log first** — `gh run view --log-failed`, `glab ci trace`, `jenkins-cli console <job>`,29 whichever this project's host provides — and quote the failing lines: a status icon names which job broke, never why.30 Log unreachable (no access, retention expired, the job never started) → report exactly that; never infer the cause.312. **Reproduce with the exact command the pipeline runs**, copied out of the CI config — same flags, same env, same32 versions. Green locally is not a pass: the environment difference is now the defect, so take it to `systematic-debugging`.333. **A re-run is not a fix.** Re-running until it passes hides the cause; re-run only to establish that a failure is34 intermittent — and an intermittent failure in this repo's own suite is a bug (`testing`), not a retry.354. **Say which failures aren't yours.** A required check owned by another change, or an external service that was36 down, is reported out of scope with the job named — silence about it reads as a clean run.3738## DoD39- All stages green; PR gates enforced; no secret leakage; build reproducible.
byerlikaya