CI/CD Pipeline — Pipeline Design, Build, Monitoring, and Optimization
An agent team collaborates to perform CI/CD pipeline design, configuration generation, security integration, and monitoring in a single pass.
Execution Mode
Agent Team — 5 members communicate directly via SendMessage and cross-validate each other's work.
Agent Composition
| Agent |
File |
Role |
Type |
| pipeline-designer |
.claude/agents/pipeline-designer.md |
Stage design, branch strategy, deployment strategy |
general-purpose |
| infra-engineer |
.claude/agents/infra-engineer.md |
Runners, containers, secrets, environment configuration |
general-purpose |
| monitoring-specialist |
.claude/agents/monitoring-specialist.md |
Metrics, alerts, dashboards, DORA |
general-purpose |
| security-scanner |
.claude/agents/security-scanner.md |
SAST, SCA, container scanning, secret detection |
general-purpose |
| pipeline-reviewer |
.claude/agents/pipeline-reviewer.md |
Efficiency, reliability, security, alignment verification |
general-purpose |
Workflow
Phase 1: Preparation (Performed directly by the orchestrator)
- Extract from user input:
- Project Type: Language/framework (Node.js, Python, Go, Java, etc.)
- CI/CD Tool: GitHub Actions / GitLab CI / Jenkins
- Deployment Target: AWS / GCP / Azure / Kubernetes / Docker
- Branch Strategy (optional): GitFlow, Trunk-based
- Existing Files (optional): Existing CI/CD configuration, Dockerfile, etc.
- Create the
_workspace/ directory at the project root
- Organize the input and save to
_workspace/00_input.md
- If existing files are provided, copy them to
_workspace/ and skip the corresponding phase
- Determine the execution mode based on the scope of the request
Phase 2: Team Assembly and Execution
| Order |
Task |
Owner |
Dependencies |
Artifact |
| 1 |
Pipeline Design |
pipeline-designer |
None |
_workspace/01_pipeline_design.md |
| 2a |
Infrastructure Config |
infra-engineer |
Task 1 |
_workspace/02_pipeline_config/, 02_infra_config.md |
| 2b |
Security Scan Design |
security-scanner |
Task 1 |
_workspace/04_security_scan.md |
| 3 |
Monitoring Design |
monitoring-specialist |
Tasks 1, 2a |
_workspace/03_monitoring.md |
| 4 |
Pipeline Review |
pipeline-reviewer |
Tasks 2a, 2b, 3 |
_workspace/05_review_report.md |
Tasks 2a (infrastructure) and 2b (security) are executed in parallel.
Inter-team communication flow:
- pipeline-designer completes -> Delivers stage requirements to infra-engineer, scan placement to security-scanner, deployment strategy to monitoring-specialist
- infra-engineer completes -> Delivers log/metric points to monitoring-specialist, image/dependency paths to security-scanner
- security-scanner completes -> Delivers security alert rules to monitoring-specialist
- pipeline-reviewer cross-validates all artifacts. When 🔴 must-fix issues are found, requests revisions from the relevant agent -> rework -> re-verify (up to 2 rounds)
Phase 3: Integration and Final Artifacts
Organize the final artifacts based on the review report:
- Verify all files in
_workspace/
- Confirm that all 🔴 must-fix items from the review report have been addressed
- Report the final summary to the user
Mode by Task Scale
| User Request Pattern |
Execution Mode |
Agents Deployed |
| "Create a CI/CD pipeline", "full design" |
Full Pipeline |
All 5 agents |
| "Just set up CI" |
CI Mode |
pipeline-designer + infra-engineer + pipeline-reviewer |
| "Add security scanning to this pipeline" (existing config) |
Security Mode |
security-scanner + pipeline-reviewer |
| "Design pipeline monitoring" (existing config) |
Monitoring Mode |
monitoring-specialist + pipeline-reviewer |
| "Review this CI/CD config" |
Review Mode |
pipeline-reviewer only |
Leveraging existing files: If the user provides YAML, Dockerfile, or other existing files, skip the corresponding steps.
Data Transfer Protocol
| Strategy |
Method |
Purpose |
| File-based |
_workspace/ directory |
Store and share primary artifacts |
| Message-based |
SendMessage |
Real-time delivery of key information, revision requests |
| Task-based |
TaskCreate/TaskUpdate |
Progress tracking, dependency management |
File naming convention: {order}_{agent}_{artifact}.{extension}
Error Handling
| Error Type |
Strategy |
| CI/CD tool not specified |
Default to GitHub Actions |
| Deployment target not specified |
Docker container-based generic configuration |
| Agent failure |
Retry once -> If still fails, proceed without that artifact; note the omission in the review report |
| 🔴 found during review |
Request revision from the relevant agent -> rework -> re-verify (up to 2 rounds) |
| Existing YAML parsing failure |
Manually analyze and create new configuration files |
Test Scenarios
Normal Flow
Prompt: "Create a GitHub Actions CI/CD pipeline for a Node.js Express app. I want to deploy to AWS ECS with a Canary deployment strategy"
Expected Result:
- Design: CI (lint -> test -> build -> scan) + CD (staging -> approval -> canary -> rollout)
- Infrastructure: GitHub Actions YAML, Dockerfile, ECR config, secret management
- Security: Semgrep + Trivy + Gitleaks configuration
- Monitoring: DORA metrics, build/deploy alerts, dashboards
- Review: All items in the alignment matrix verified
Existing File Flow
Prompt: "Add security scanning to this GitHub Actions config" + YAML file
Expected Result:
- Copy existing YAML to
_workspace/02_pipeline_config/
- Security mode: deploy security-scanner + pipeline-reviewer
- Skip pipeline-designer, infra-engineer, monitoring-specialist
Error Flow
Prompt: "Create a CI/CD quickly, Python project"
Expected Result:
- Deployment target not specified -> Docker-based generic design
- GitHub Actions selected as default
- Review report notes "deployment target unspecified, Docker container-based generic configuration"
Agent Extension Skills
Extension skills that enhance each agent's domain expertise:
| Skill |
Target Agent |
Role |
pipeline-security-gates |
security-scanner |
SAST/SCA/secret detection tool selection, gate placement, thresholds |
deployment-strategies |
pipeline-designer |
Blue-Green/Canary/Rolling deployment, rollback, DORA metrics |
1---2name: cicd-pipeline3description: Full pipeline for CI/CD pipeline design, build, monitoring, and optimization. An agent team collaborates to perform stage design, YAML configuration generation, security scan integration, and monitoring/alert design. Use this skill for any CI/CD task including 'create a CI/CD pipeline', 'GitHub Actions', 'GitLab CI', 'Jenkins pipeline', 'deployment automation', 'build pipeline', 'DevOps pipeline', 'auto deploy', 'CI setup', 'CD setup', etc. Also supports optimization and security hardening for existing pipelines. Note: actual infrastructure provisioning (AWS/GCP resource creation), server configuration, and cluster management are outside the scope of this skill.4---56# CI/CD Pipeline — Pipeline Design, Build, Monitoring, and Optimization78An agent team collaborates to perform CI/CD pipeline design, configuration generation, security integration, and monitoring in a single pass.910## Execution Mode1112**Agent Team** — 5 members communicate directly via SendMessage and cross-validate each other's work.1314## Agent Composition1516| Agent | File | Role | Type |17|-------|------|------|------|18| pipeline-designer | `.claude/agents/pipeline-designer.md` | Stage design, branch strategy, deployment strategy | general-purpose |19| infra-engineer | `.claude/agents/infra-engineer.md` | Runners, containers, secrets, environment configuration | general-purpose |20| monitoring-specialist | `.claude/agents/monitoring-specialist.md` | Metrics, alerts, dashboards, DORA | general-purpose |21| security-scanner | `.claude/agents/security-scanner.md` | SAST, SCA, container scanning, secret detection | general-purpose |22| pipeline-reviewer | `.claude/agents/pipeline-reviewer.md` | Efficiency, reliability, security, alignment verification | general-purpose |2324## Workflow2526### Phase 1: Preparation (Performed directly by the orchestrator)27281. Extract from user input:29 - **Project Type**: Language/framework (Node.js, Python, Go, Java, etc.)30 - **CI/CD Tool**: GitHub Actions / GitLab CI / Jenkins31 - **Deployment Target**: AWS / GCP / Azure / Kubernetes / Docker32 - **Branch Strategy** (optional): GitFlow, Trunk-based33 - **Existing Files** (optional): Existing CI/CD configuration, Dockerfile, etc.342. Create the `_workspace/` directory at the project root353. Organize the input and save to `_workspace/00_input.md`364. If existing files are provided, copy them to `_workspace/` and skip the corresponding phase375. Determine the **execution mode** based on the scope of the request3839### Phase 2: Team Assembly and Execution4041| Order | Task | Owner | Dependencies | Artifact |42|-------|------|-------|-------------|----------|43| 1 | Pipeline Design | pipeline-designer | None | `_workspace/01_pipeline_design.md` |44| 2a | Infrastructure Config | infra-engineer | Task 1 | `_workspace/02_pipeline_config/`, `02_infra_config.md` |45| 2b | Security Scan Design | security-scanner | Task 1 | `_workspace/04_security_scan.md` |46| 3 | Monitoring Design | monitoring-specialist | Tasks 1, 2a | `_workspace/03_monitoring.md` |47| 4 | Pipeline Review | pipeline-reviewer | Tasks 2a, 2b, 3 | `_workspace/05_review_report.md` |4849Tasks 2a (infrastructure) and 2b (security) are **executed in parallel**.5051**Inter-team communication flow:**52- pipeline-designer completes -> Delivers stage requirements to infra-engineer, scan placement to security-scanner, deployment strategy to monitoring-specialist53- infra-engineer completes -> Delivers log/metric points to monitoring-specialist, image/dependency paths to security-scanner54- security-scanner completes -> Delivers security alert rules to monitoring-specialist55- pipeline-reviewer cross-validates all artifacts. When 🔴 must-fix issues are found, requests revisions from the relevant agent -> rework -> re-verify (up to 2 rounds)5657### Phase 3: Integration and Final Artifacts5859Organize the final artifacts based on the review report:60611. Verify all files in `_workspace/`622. Confirm that all 🔴 must-fix items from the review report have been addressed633. Report the final summary to the user6465## Mode by Task Scale6667| User Request Pattern | Execution Mode | Agents Deployed |68|---------------------|----------------|-----------------|69| "Create a CI/CD pipeline", "full design" | **Full Pipeline** | All 5 agents |70| "Just set up CI" | **CI Mode** | pipeline-designer + infra-engineer + pipeline-reviewer |71| "Add security scanning to this pipeline" (existing config) | **Security Mode** | security-scanner + pipeline-reviewer |72| "Design pipeline monitoring" (existing config) | **Monitoring Mode** | monitoring-specialist + pipeline-reviewer |73| "Review this CI/CD config" | **Review Mode** | pipeline-reviewer only |7475**Leveraging existing files**: If the user provides YAML, Dockerfile, or other existing files, skip the corresponding steps.7677## Data Transfer Protocol7879| Strategy | Method | Purpose |80|----------|--------|---------|81| File-based | `_workspace/` directory | Store and share primary artifacts |82| Message-based | SendMessage | Real-time delivery of key information, revision requests |83| Task-based | TaskCreate/TaskUpdate | Progress tracking, dependency management |8485File naming convention: `{order}_{agent}_{artifact}.{extension}`8687## Error Handling8889| Error Type | Strategy |90|-----------|----------|91| CI/CD tool not specified | Default to GitHub Actions |92| Deployment target not specified | Docker container-based generic configuration |93| Agent failure | Retry once -> If still fails, proceed without that artifact; note the omission in the review report |94| 🔴 found during review | Request revision from the relevant agent -> rework -> re-verify (up to 2 rounds) |95| Existing YAML parsing failure | Manually analyze and create new configuration files |9697## Test Scenarios9899### Normal Flow100**Prompt**: "Create a GitHub Actions CI/CD pipeline for a Node.js Express app. I want to deploy to AWS ECS with a Canary deployment strategy"101**Expected Result**:102- Design: CI (lint -> test -> build -> scan) + CD (staging -> approval -> canary -> rollout)103- Infrastructure: GitHub Actions YAML, Dockerfile, ECR config, secret management104- Security: Semgrep + Trivy + Gitleaks configuration105- Monitoring: DORA metrics, build/deploy alerts, dashboards106- Review: All items in the alignment matrix verified107108### Existing File Flow109**Prompt**: "Add security scanning to this GitHub Actions config" + YAML file110**Expected Result**:111- Copy existing YAML to `_workspace/02_pipeline_config/`112- Security mode: deploy security-scanner + pipeline-reviewer113- Skip pipeline-designer, infra-engineer, monitoring-specialist114115### Error Flow116**Prompt**: "Create a CI/CD quickly, Python project"117**Expected Result**:118- Deployment target not specified -> Docker-based generic design119- GitHub Actions selected as default120- Review report notes "deployment target unspecified, Docker container-based generic configuration"121122## Agent Extension Skills123124Extension skills that enhance each agent's domain expertise:125126| Skill | Target Agent | Role |127|-------|-------------|------|128| `pipeline-security-gates` | security-scanner | SAST/SCA/secret detection tool selection, gate placement, thresholds |129| `deployment-strategies` | pipeline-designer | Blue-Green/Canary/Rolling deployment, rollback, DORA metrics |