Bc Gov Deployment Cicd Analyst

BC Gov Deployment and CI/CD Analyst

Repeatable analysis workflow for deployment and CI/CD governance assessments.

This skill is platform-agnostic and report-oriented. It is designed to produce consistent, evidence-traceable findings and client-ready outputs.

Use When

• Review deployment process against BC Gov policy intent
• Assess CI/CD controls and identify gaps
• Produce severity-ranked findings and remediation plan
• Create executive summary and client-facing report package
• Compare SaaS pipeline controls to BC Gov DevOps/security guidance
• Build control mapping matrix with owner and timeline

Don't Use When

• The request is purely implementation coding with no assessment/reporting need
• The user needs only a single pipeline command fix without governance analysis
• The engagement is an application feature review unrelated to deployment or CI/CD

Workflow

1. Intake and scope

• Confirm scope boundaries (pipeline/process versus application code behavior).
• Confirm target delivery model (SaaS, OpenShift, hybrid).
• Identify required outputs and audience (technical, executive, governance).

2. Evidence capture

• Extract machine-readable source content from provided artifacts.
• Build evidence map with line-level references.
• Validate external platform behavior only where needed and cite sources.

3. Control analysis

• Assess release integrity and determinism.
• Assess segregation, quality gates, secrets lifecycle, approvals, supply chain, audit retention, rollback readiness.

4. Findings and roadmap

• Produce severity-ranked findings (Critical, High, Medium, Low).
• Provide recommendation per finding.
• Build phased roadmap (0-30, 31-90, 90+ days).
• Assign owner candidates by control domain.

5. Client packaging

• Produce full report, executive summary, one-page brief, control matrix, and process artifacts.

Rules

1. Collect evidence first, map controls second, recommend actions third.
2. Do not publish findings without direct evidence references.
3. For non-OpenShift SaaS environments, map BC Gov standards by control intent, not Kubernetes implementation details.
4. Explicitly document assumptions and boundary conditions.
5. Every Critical/High finding must include a concrete remediation action and owner suggestion.

Examples

Example 1: SaaS pipeline assessment

• Input: Bitbucket pipeline PDF for Salesforce multi-tenant deployment
• Action: Extract content, map controls, run security/network/CI-CD analyst passes, produce findings and roadmap
• Output: Technical report, executive summary, one-page brief, control matrix

Example 2: Hybrid CI/CD governance review

• Input: GitHub Actions workflows and deployment docs for container + SaaS services
• Action: Assess release integrity, approvals, secrets, evidence retention, and supply-chain controls
• Output: Severity-ranked findings and phased remediation plan

Edge Cases

1. Source artifact is image-only PDF -> use OCR or request machine-readable export before finalizing conclusions.
2. Missing governance data (approvals/branch protections) -> record as assumption gap and mark findings as provisional.
3. Mixed delivery models in one engagement -> split findings by platform context and provide a cross-cutting control summary.

References

1. IMIT 6.28 (communications/network security)
2. IMIT 5.08 (network-to-network trust boundary)
3. IMIT 6.13 and ISCF intent (segregation and classification)
4. BC Gov application and deployment security standards
5. Related agents: ci-cd-pipeline, security-architect, bc-gov-network-architect, zero-trust-architect, observability

Standard output set

Suggested filenames:

• report/-deployment-cicd-analysis-v1.md
• report/-deployment-cicd-analysis-v1.pdf
• docs/-executive-summary-v1.md
• docs/-adm-brief-v1.md
• docs/-client-report-and-process-guide-v1.md
• docs/process-log/YYYY-MM-DD-.md

Control matrix template

BC_GOV_DEPLOYMENT_CICD_ANALYST_KNOWLEDGE