How do I install the CI CD Conformance skill?

Run npx skillmds@latest add tomevault-io/ci-cd-conformance in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is CI CD Conformance safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with CI CD Conformance?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is CI CD Conformance free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published CI CD Conformance?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

CI CD Conformance by tomevault-io — Agent Skill

Name: CI CD Conformance
Author: tomevault-io

CI CD Conformance

Use when user creates/modifies CI/CD pipelines, mentions deployment automation, quality gates, or release processes. Applies to all repositories by default to ensure platform-specific best practices (dependency scanning, secret detection, protected branches).

tomevault-io e3e8630 2 files · 3.9 KB Updated Sep 17, 2026

File contents

CI/CD Conformance

Overview

P1 Quality & Correctness - Enforces quality gates, immutable releases, and platform security features. Prevents defective deployments.

REQUIRED: superpowers:verification-before-completion, superpowers:brainstorming

When to Use

Creating/modifying CI/CD pipelines
Deployment automation, quality gates, release processes
Default: Applies to all repositories
Opt-out: User explicitly refuses

Core Workflow

Detect CI/CD provider (GitHub Actions, Azure Pipelines, GitLab CI, Jenkins)
Prompt CLI install if missing (gh, az, glab)
Announce skill application
Configure quality gates: tests, linting, security scan, coverage threshold
Configure immutable releases: tag-triggered deployments only
Configure incremental execution: caching, conditional jobs
Enable platform security: dependency scanning, secret detection, branch protection
Configure OIDC/managed identity (eliminate long-lived secrets)
Document pipeline in docs/ci-cd-pipeline.md
Add status badge and summary to README.md

Quick Reference

Provider	CLI	Security Features
GitHub Actions	gh	Dependabot, CodeQL, secret scanning, OIDC
Azure Pipelines	az	Advanced security, credential scanning
GitLab CI	glab	SAST, DAST, dependency scanning
Jenkins	jenkins	Plugin-based security

See Provider Configuration for setup details.

Red Flags - STOP

"Can add quality gates later"
"Security scanning not needed"
"Just need basic deployment"
"Branch protection is extra"
"Existing pipeline is fine"

All of these mean: Apply skill. CI/CD without quality gates is deployment automation, not CI/CD.

Rationalizations

Excuse	Reality
"Can add quality gates after demo"	Demo deploys become production. Quality gates prevent defects.
"Customer doesn't care about scanning"	Data breaches affect all customers. Security is non-negotiable.
"Branch protection is separate"	CI/CD setup includes security. Incomplete setup creates risk.
"Existing pipeline has worked"	Lack of gates accumulates technical debt.
"Migration risk not worth it"	Risk of NOT having gates exceeds migration risk.

See Brownfield Migration for incremental approaches.

Source: mcj-coder/development-skills — distributed by TomeVault.

---name: ci-cd-conformancedescription: Use when user creates/modifies CI/CD pipelines, mentions deployment automation, quality gates, or release processes. Applies to all repositories by default to ensure platform-specific best practices (dependency scanning, secret detection, protected branches).---# CI/CD Conformance## Overview**P1 Quality & Correctness** - Enforces quality gates, immutable releases, and platformsecurity features. Prevents defective deployments.**REQUIRED:** superpowers:verification-before-completion, superpowers:brainstorming## When to Use- Creating/modifying CI/CD pipelines- Deployment automation, quality gates, release processes- **Default**: Applies to all repositories- **Opt-out**: User explicitly refuses## Core Workflow1. Detect CI/CD provider (GitHub Actions, Azure Pipelines, GitLab CI, Jenkins)2. Prompt CLI install if missing (gh, az, glab)3. Announce skill application4. Configure quality gates: tests, linting, security scan, coverage threshold5. Configure immutable releases: tag-triggered deployments only6. Configure incremental execution: caching, conditional jobs7. Enable platform security: dependency scanning, secret detection, branch protection8. Configure OIDC/managed identity (eliminate long-lived secrets)9. Document pipeline in docs/ci-cd-pipeline.md10. Add status badge and summary to README.md## Quick Reference| Provider | CLI | Security Features || --------------- | ------- | ----------------------------------------- || GitHub Actions | gh | Dependabot, CodeQL, secret scanning, OIDC || Azure Pipelines | az | Advanced security, credential scanning || GitLab CI | glab | SAST, DAST, dependency scanning || Jenkins | jenkins | Plugin-based security |See [Provider Configuration](references/provider-configuration.md) for setup details.## Red Flags - STOP- "Can add quality gates later"- "Security scanning not needed"- "Just need basic deployment"- "Branch protection is extra"- "Existing pipeline is fine"All of these mean: Apply skill. CI/CD without quality gates is deployment automation,not CI/CD.## Rationalizations| Excuse | Reality || -------------------------------------- | --------------------------------------------------------------- || "Can add quality gates after demo" | Demo deploys become production. Quality gates prevent defects. || "Customer doesn't care about scanning" | Data breaches affect all customers. Security is non-negotiable. || "Branch protection is separate" | CI/CD setup includes security. Incomplete setup creates risk. || "Existing pipeline has worked" | Lack of gates accumulates technical debt. || "Migration risk not worth it" | Risk of NOT having gates exceeds migration risk. |See [Brownfield Migration](references/brownfield-migration.md) for incremental approaches.---> Source: [mcj-coder/development-skills](https://github.com/mcj-coder/development-skills) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions