# CI CD And Automation

> Shift Left quality gates, CI pipeline design, feature flags for safe deployment. Use when this capability is needed.

- Skill: `tomevault-io/ci-cd-and-automation-22` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/ci-cd-and-automation-22`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/ci-cd-and-automation-22/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/ci-cd-and-automation-22

---


## 1. Trigger Conditions

Invoke this skill when:

- `/ship` slash command is issued
- A new feature is about to be merged to the main branch
- Setting up a CI/CD pipeline for a new project
- Adding a new quality gate (lint, test, security scan) to an existing pipeline
- Implementing a feature that needs a feature flag for gradual rollout

## 2. Prerequisites

- Code is committed and reviewed
- Test suite exists and passes locally
- Repository access to create/modify CI config files (`.github/workflows/`, etc.)

## 3. Steps

### 3a. Shift Left — Move Quality Checks Earlier

The Shift Left principle: catch defects as early as possible in the development cycle. Apply these gates in order (fastest first):

1. **Pre-commit hooks** — lint + type-check (< 5 seconds). Run before every commit.
2. **PR checks** — unit tests + integration tests (< 3 minutes). Block merge on failure.
3. **Pre-merge checks** — E2E tests + security scan (< 10 minutes). Run on PR approval.
4. **Post-merge checks** — performance benchmarks, full E2E suite. Non-blocking on merge, blocking on deploy.

### 3b. CI Pipeline Design

A complete pipeline has these stages in order:

```
Stage 1: Install & Cache
  → npm ci (not npm install)
  → Cache node_modules by package-lock.json hash

Stage 2: Static Analysis (parallel)
  → Lint (ESLint)
  → Type check (tsc --noEmit)
  → Format check (Prettier)

Stage 3: Tests (parallel)
  → Unit tests with coverage report
  → Integration tests

Stage 4: Security
  → npm audit --audit-level=high
  → Dependency licence check (if required)

Stage 5: Build
  → Production build
  → Bundle size check (fail if > threshold)

Stage 6: E2E (on PR to main/staging only)
  → Playwright tests against preview deployment

Stage 7: Deploy (main branch only, after all stages pass)
  → Deploy to staging
  → Smoke test
  → Deploy to production (manual gate or auto)
```

### 3c. Feature Flags

Use feature flags when:
- A feature affects a large portion of users
- A feature has a dependency on a backend change not yet deployed
- A gradual rollout is needed (10% → 50% → 100%)
- A kill switch is needed for quick rollback without a deploy

Feature flag rules:
- Flag names use the format `feat_<feature_slug>` (e.g. `feat_new_checkout`)
- Default state is `off` (new features start disabled)
- Flags are removed within 2 sprints of reaching 100% rollout
- Never commit code that only works with a flag permanently enabled

### 3d. Quality Gate Thresholds

Define these explicitly in CI config — do not leave as defaults:

| Gate | Recommended Threshold |
|------|-----------------------|
| Test coverage | ≥ 80% lines for new code |
| Bundle size increase | ≤ 5% vs main branch |
| npm audit severity | Block on Critical and High |
| Lighthouse performance score | ≥ 80 (for user-facing pages) |
| Build time | Alert if > 10 minutes |

## 4. Anti-Rationalization Table

| Excuse the agent will use | Rebuttal |
|--------------------------|---------|
| "CI is set up already, I don't need to add a gate for this" | New features introduce new failure modes. Add the gate. |
| "The tests pass locally, CI is just a formality" | "Works on my machine" is not a deployment standard. |
| "Feature flags add complexity" | They add complexity that prevents outages. The tradeoff is correct. |
| "I'll set up CI after the MVP ships" | CI set up after MVP = CI never set up. Build it in from the start. |
| "Coverage gates are arbitrary" | Uncovered code is unknown code. The gate forces you to think about it. |

## 5. Red Flags

Signs this skill is being violated:

- Merging to main without all CI stages passing
- No automated tests in the pipeline
- Deployment triggered manually without a pipeline gate
- Feature with significant user impact deployed without a feature flag
- `npm install` used in CI instead of `npm ci`
- No coverage threshold defined — all coverage reports are informational only

## 6. Verification Gate

Before marking this skill complete:

- [ ] All CI stages defined and passing for the current PR
- [ ] Static analysis stage runs in < 5 minutes
- [ ] Unit + integration tests run in < 3 minutes on CI
- [ ] `npm audit --audit-level=high` in pipeline — currently passing
- [ ] Bundle size check present (web apps)
- [ ] Feature flag added if feature affects >10% of users or has a kill-switch requirement
- [ ] Pipeline config committed to version control
- [ ] No secrets in CI config — all secrets via environment variables

## 7. References

- [github-actions-template.yml](references/github-actions-template.yml) — Starter CI pipeline for Node/React
- [feature-flag-patterns.md](references/feature-flag-patterns.md) — Feature flag naming and lifecycle

---
> Source: [bhargavgandhi/agentic-workflows](https://github.com/bhargavgandhi/agentic-workflows) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-15 -->