How do I install the CI CD Patterns skill?

Run npx skillmds@latest add tomevault-io/ci-cd-patterns-4 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is CI CD Patterns safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with CI CD Patterns?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is CI CD Patterns free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published CI CD Patterns?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

CI CD Patterns by tomevault-io — Agent Skill

Name: CI CD Patterns
Author: tomevault-io

File contents

CI/CD Patterns

Build pipelines that prove a change is safe before release and make deployment reversible. Keep CI deterministic, fast, and least-privileged.

Workflow

Identify required quality gates: format, lint, typecheck, tests, build, image scan, contract tests.
Run fast checks first and avoid deployment work on untrusted pull requests.
Build immutable artifacts once; promote the same artifact across environments.
Use environment-scoped secrets and approvals for production.
Publish test reports, coverage, SBOM/provenance, and deployment metadata.
Define rollback before deploying.

Pipeline Shape

pull_request:
  install -> lint -> typecheck -> unit tests -> build

main:
  install -> full test -> build artifact/image -> scan -> publish -> deploy staging

release:
  promote known artifact -> deploy prod -> smoke test -> monitor -> rollback if needed

Production Rules

Use lockfile-based installs: pnpm install --frozen-lockfile.
Cache package stores, not node_modules, unless the platform explicitly supports it safely.
Give jobs explicit permissions; default to read-only.
Use OIDC federation for cloud deploys instead of long-lived cloud keys.
Pin third-party actions/images by version or digest according to risk policy.
Never deploy from unreviewed fork PR contexts.
Keep secrets out of logs and build arguments.

Example Commands

pnpm install --frozen-lockfile
pnpm typecheck
pnpm test -- --run
pnpm build
docker buildx build --provenance=true --sbom=true .

Verification

Confirm CI fails on type errors and test failures.
Confirm production deploy requires protected branch/environment.
Confirm artifact digest is the same across staging and production.
Confirm rollback command works from a clean terminal.

Resources

GitHub Actions Security Hardening - Official workflow security guidance.
GitHub OIDC - Cloud auth without long-lived secrets.
SLSA - Supply-chain integrity framework.
Docker Build CI - Buildx CI patterns.

Principles

CI proves; CD promotes.
Build once, deploy many.
Least privilege for every job.
Rollback is part of delivery.
Reproducibility beats clever caching.

Source: ig-vikas/SkillRegistry — distributed by TomeVault.

---name: ci-cd-patterns-4description: CI/CD pipeline patterns for reliable builds, tests, artifacts, deployments, environment promotion, supply-chain security, and rollback-safe delivery. Use when this capability is needed.---# CI/CD PatternsBuild pipelines that prove a change is safe before release and make deployment reversible. Keep CI deterministic, fast, and least-privileged.## Workflow1. Identify required quality gates: format, lint, typecheck, tests, build, image scan, contract tests.2. Run fast checks first and avoid deployment work on untrusted pull requests.3. Build immutable artifacts once; promote the same artifact across environments.4. Use environment-scoped secrets and approvals for production.5. Publish test reports, coverage, SBOM/provenance, and deployment metadata.6. Define rollback before deploying.## Pipeline Shape```textpull_request: install -> lint -> typecheck -> unit tests -> buildmain: install -> full test -> build artifact/image -> scan -> publish -> deploy stagingrelease: promote known artifact -> deploy prod -> smoke test -> monitor -> rollback if needed```## Production Rules- Use lockfile-based installs: `pnpm install --frozen-lockfile`.- Cache package stores, not `node_modules`, unless the platform explicitly supports it safely.- Give jobs explicit permissions; default to read-only.- Use OIDC federation for cloud deploys instead of long-lived cloud keys.- Pin third-party actions/images by version or digest according to risk policy.- Never deploy from unreviewed fork PR contexts.- Keep secrets out of logs and build arguments.## Example Commands```bashpnpm install --frozen-lockfilepnpm typecheckpnpm test -- --runpnpm builddocker buildx build --provenance=true --sbom=true .```## Verification- Confirm CI fails on type errors and test failures.- Confirm production deploy requires protected branch/environment.- Confirm artifact digest is the same across staging and production.- Confirm rollback command works from a clean terminal.## Resources- **[GitHub Actions Security Hardening](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)** - Official workflow security guidance.- **[GitHub OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)** - Cloud auth without long-lived secrets.- **[SLSA](https://slsa.dev/)** - Supply-chain integrity framework.- **[Docker Build CI](https://docs.docker.com/build/ci/)** - Buildx CI patterns.## Principles1. CI proves; CD promotes.2. Build once, deploy many.3. Least privilege for every job.4. Rollback is part of delivery.5. Reproducibility beats clever caching.---> Source: [ig-vikas/SkillRegistry](https://github.com/ig-vikas/SkillRegistry) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions

CI CD Patterns