# Bc Gov Deployment Cicd Analyst

> Generic BC Gov deployment and CI/CD assessment orchestrator for SaaS, container, and hybrid delivery pipelines. Use when producing evidence-based deployment governance reports, control matrices, remediation roadmaps, and executive summaries across platforms such as GitHub Actions, Bitbucket Pipelines, Azure DevOps, and GitLab CI.

- Skill: `rloisell/bc-gov-deployment-cicd-analyst` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add rloisell/bc-gov-deployment-cicd-analyst`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rloisell/bc-gov-deployment-cicd-analyst/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: rloisell (https://skillmd.com/u/rloisell)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/rloisell/bc-gov-deployment-cicd-analyst

---


# BC Gov Deployment and CI/CD Analyst

Repeatable analysis workflow for deployment and CI/CD governance assessments.

This skill is platform-agnostic and report-oriented. It is designed to produce consistent, evidence-traceable findings and client-ready outputs.

## Use When

- Review deployment process against BC Gov policy intent
- Assess CI/CD controls and identify gaps
- Produce severity-ranked findings and remediation plan
- Create executive summary and client-facing report package
- Compare SaaS pipeline controls to BC Gov DevOps/security guidance
- Build control mapping matrix with owner and timeline

## Don't Use When

- The request is purely implementation coding with no assessment/reporting need
- The user needs only a single pipeline command fix without governance analysis
- The engagement is an application feature review unrelated to deployment or CI/CD

## Workflow

1. Intake and scope
  - Confirm scope boundaries (pipeline/process versus application code behavior).
  - Confirm target delivery model (SaaS, OpenShift, hybrid).
  - Identify required outputs and audience (technical, executive, governance).
2. Evidence capture
  - Extract machine-readable source content from provided artifacts.
  - Build evidence map with line-level references.
  - Validate external platform behavior only where needed and cite sources.
3. Control analysis
  - Assess release integrity and determinism.
  - Assess segregation, quality gates, secrets lifecycle, approvals, supply chain, audit retention, rollback readiness.
4. Findings and roadmap
  - Produce severity-ranked findings (Critical, High, Medium, Low).
  - Provide recommendation per finding.
  - Build phased roadmap (0-30, 31-90, 90+ days).
  - Assign owner candidates by control domain.
5. Client packaging
  - Produce full report, executive summary, one-page brief, control matrix, and process artifacts.

## Rules

1. Collect evidence first, map controls second, recommend actions third.
2. Do not publish findings without direct evidence references.
3. For non-OpenShift SaaS environments, map BC Gov standards by control intent, not Kubernetes implementation details.
4. Explicitly document assumptions and boundary conditions.
5. Every Critical/High finding must include a concrete remediation action and owner suggestion.

## Examples

### Example 1: SaaS pipeline assessment

- Input: Bitbucket pipeline PDF for Salesforce multi-tenant deployment
- Action: Extract content, map controls, run security/network/CI-CD analyst passes, produce findings and roadmap
- Output: Technical report, executive summary, one-page brief, control matrix

### Example 2: Hybrid CI/CD governance review

- Input: GitHub Actions workflows and deployment docs for container + SaaS services
- Action: Assess release integrity, approvals, secrets, evidence retention, and supply-chain controls
- Output: Severity-ranked findings and phased remediation plan

## Edge Cases

1. Source artifact is image-only PDF -> use OCR or request machine-readable export before finalizing conclusions.
2. Missing governance data (approvals/branch protections) -> record as assumption gap and mark findings as provisional.
3. Mixed delivery models in one engagement -> split findings by platform context and provide a cross-cutting control summary.

## References

1. IMIT 6.28 (communications/network security)
2. IMIT 5.08 (network-to-network trust boundary)
3. IMIT 6.13 and ISCF intent (segregation and classification)
4. BC Gov application and deployment security standards
5. Related agents: ci-cd-pipeline, security-architect, bc-gov-network-architect, zero-trust-architect, observability

## Standard output set

Suggested filenames:

- report/<program>-deployment-cicd-analysis-v1.md
- report/<program>-deployment-cicd-analysis-v1.pdf
- docs/<program>-executive-summary-v1.md
- docs/<program>-adm-brief-v1.md
- docs/<program>-client-report-and-process-guide-v1.md
- docs/process-log/YYYY-MM-DD-<title>.md

## Control matrix template

| Control ID | Control Domain | Current State | Evidence | Gap | Recommended Action | Owner | Target Date |
|---|---|---|---|---|---|---|---|
| CM-01 | Release Integrity |  |  |  |  |  |  |
| CM-02 | Quality Gates |  |  |  |  |  |  |
| CM-03 | Secrets Lifecycle |  |  |  |  |  |  |
| CM-04 | Governance Approval |  |  |  |  |  |  |
| CM-05 | Audit Retention |  |  |  |  |  |  |

---

## BC_GOV_DEPLOYMENT_CICD_ANALYST_KNOWLEDGE

<!-- agent-evolution appends discoveries here -->
<!-- Format: - YYYY-MM-DD: [engagement] <imperative statement> -->