How do I install the CI CD Pipelines skill?

Run npx skillmds@latest add tomevault-io/ci-cd-pipelines-7 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is CI CD Pipelines safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with CI CD Pipelines?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is CI CD Pipelines free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published CI CD Pipelines?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

CI CD Pipelines by tomevault-io — Agent Skill

Name: CI CD Pipelines
Author: tomevault-io

CI CD Pipelines

GitHub Actions best practices — workflow structure, caching, security hardening, matrix builds, and reusable workflows. Use when designing, debugging, or optimizing CI/CD pipelines. Use when this capability is needed.

tomevault-io Updated Sep 17, 2026

File contents

CI/CD Pipelines

Core principle: A CI/CD pipeline is production infrastructure. It should be fast, secure, deterministic, and easy to debug when it fails.

Topic Selection

Working on...	Load	File
Workflow structure, triggers, job design	Structure	`references/structure.md`
Caching dependencies, build artifacts	Caching	`references/caching.md`
Secrets, permissions, supply chain	Security	`references/security.md`
Matrix builds, parallelism, environments	Scaling	`references/scaling.md`

Core Principles

Fast feedback loops

Developers context-switch when CI takes too long. Target: < 5 min for unit tests, < 15 min for full suite.

Run cheap checks first (lint, type-check, unit tests)
Parallelize independent jobs
Cache aggressively — dependency install is usually the slowest step
Use paths filters to skip unnecessary runs

Determinism over convenience

Flaky pipelines destroy trust. Every non-deterministic element is a bug waiting to happen.

Pin action versions to a commit SHA, not a floating tag
Use lockfiles (package-lock.json, poetry.lock, go.sum)
Seed randomness in tests explicitly
Avoid sleep — use condition polling or wait steps

Minimal permissions

Workflows run with elevated access. Apply least-privilege at every level.

permissions:
  contents: read  # Start here. Add only what's needed.

Never use permissions: write-all or omit the permissions block on workflows that handle PRs.

Fail fast, fail clearly

A failing pipeline should tell you exactly what's wrong in < 30 seconds of log reading.

Use ::error:: annotations for critical failures
Group output with ::group:: / ::endgroup::
Exit immediately on error (set -euo pipefail in bash steps)
Use if: failure() steps to capture and upload artifacts on failure

Common Patterns

Dependency caching (Node)

- uses: actions/setup-node@v4
  with:
    node-version: '20'
    cache: 'npm'

- run: npm ci

Reusable workflow call

jobs:
  test:
    uses: ./.github/workflows/test.yml
    with:
      environment: staging
    secrets: inherit

Matrix build

strategy:
  matrix:
    os: [ubuntu-latest, macos-latest]
    node: ['18', '20']
  fail-fast: false

Conditional deploy

- name: Deploy to production
  if: github.ref == 'refs/heads/main' && github.event_name == 'push'
  run: ./scripts/deploy.sh production

Source: kirvin/copilot-cli-essentials — distributed by TomeVault.

---name: ci-cd-pipelines-7description: GitHub Actions best practices — workflow structure, caching, security hardening, matrix builds, and reusable workflows. Use when designing, debugging, or optimizing CI/CD pipelines. Use when this capability is needed.---# CI/CD Pipelines**Core principle:** A CI/CD pipeline is production infrastructure. It should be fast, secure, deterministic, and easy to debug when it fails.## Topic Selection| Working on... | Load | File ||---------------|------|------|| Workflow structure, triggers, job design | **Structure** | `references/structure.md` || Caching dependencies, build artifacts | **Caching** | `references/caching.md` || Secrets, permissions, supply chain | **Security** | `references/security.md` || Matrix builds, parallelism, environments | **Scaling** | `references/scaling.md` |---## Core Principles### Fast feedback loopsDevelopers context-switch when CI takes too long. Target: < 5 min for unit tests, < 15 min for full suite.- Run cheap checks first (lint, type-check, unit tests)- Parallelize independent jobs- Cache aggressively — dependency install is usually the slowest step- Use `paths` filters to skip unnecessary runs### Determinism over convenienceFlaky pipelines destroy trust. Every non-deterministic element is a bug waiting to happen.- Pin action versions to a commit SHA, not a floating tag- Use lockfiles (`package-lock.json`, `poetry.lock`, `go.sum`)- Seed randomness in tests explicitly- Avoid `sleep` — use condition polling or wait steps### Minimal permissionsWorkflows run with elevated access. Apply least-privilege at every level.```yamlpermissions: contents: read # Start here. Add only what's needed.```Never use `permissions: write-all` or omit the `permissions` block on workflows that handle PRs.### Fail fast, fail clearlyA failing pipeline should tell you exactly what's wrong in < 30 seconds of log reading.- Use `::error::` annotations for critical failures- Group output with `::group::` / `::endgroup::`- Exit immediately on error (`set -euo pipefail` in bash steps)- Use `if: failure()` steps to capture and upload artifacts on failure---## Common Patterns### Dependency caching (Node)```yaml- uses: actions/setup-node@v4 with: node-version: '20' cache: 'npm'- run: npm ci```### Reusable workflow call```yamljobs: test: uses: ./.github/workflows/test.yml with: environment: staging secrets: inherit```### Matrix build```yamlstrategy: matrix: os: [ubuntu-latest, macos-latest] node: ['18', '20'] fail-fast: false```### Conditional deploy```yaml- name: Deploy to production if: github.ref == 'refs/heads/main' && github.event_name == 'push' run: ./scripts/deploy.sh production```---> Source: [kirvin/copilot-cli-essentials](https://github.com/kirvin/copilot-cli-essentials) — distributed by [TomeVault](https://tomevault.io).

Frequently asked questions