Josephsanjaya Skills CI CD Expert

CI/CD Expert

Quick Decision Tree

What need?
├── Platform selection → references/platforms.md
├── GitHub Actions architecture → references/github-actions.md
├── GitLab CI optimization → references/gitlab-ci.md
├── Monorepo pipeline (JS/TS) → references/monorepo-frontend.md
├── Monorepo pipeline (compiled) → references/monorepo-bazel.md
├── Container builds (K8s) → references/container-builds.md
├── GitOps + ArgoCD deploy → references/gitops-argocd.md
├── DB migrations in pipeline → references/db-migrations.md
├── Canary / progressive delivery → references/progressive-delivery.md
├── Mobile CI/CD (iOS/Android) → references/mobile-devops.md
├── Android affected modules & testing → references/android-affected-testing.md
├── Android signing & release → references/android-signing-release.md
├── Android Gradle tuning & caching → references/android-gradle-tuning.md
├── Android pre-merge & emulator → references/android-emulator-validation.md
├── Android runner memory & swap → references/android-runners-memory.md
├── Pipeline security (OIDC/PPE) → references/security-oidc.md
└── Full config samples → references/samples.md

Core Principles

1. DAG > Sequential. Never chain jobs linearly. Use needs (GitLab) or job dependencies (GHA) for parallel fan-out/fan-in.
2. Cache everything. Hash lock files for cache keys. Use fallback keys. Distribute cache via S3/NFS at scale.
3. Impact radius only. Never rebuild world. Use affected/changed detection (Nx, Turborepo, Bazel, dropbox/affectedmoduledetector, git diff).
4. Immutable tags. Use Git SHA tags (v1.2.3-a3f5b2c), never latest. Pin 3rd-party actions to commit SHAs.
5. Zero static secrets. OIDC federation for cloud access. Short-lived JWT tokens. No long-lived IAM keys.
6. GitOps pull > CI push. ArgoCD/Flux pull from Git. Never kubectl apply from CI runner.
7. Fail fast. Lint/syntax first. interruptible: true on superseded commits. Kill redundant jobs.
8. Build once, promote. Single artifact through all environments. No per-env rebuilds.

Platform Selection Cheat Sheet

GitHub Actions: Reusable Workflows vs Composite Actions

Rule: Workflows = pipeline templates. Actions = task templates. Never mix.

GitLab CI: DAG + Dynamic Pipelines

# Fan-out with needs (bypass stage waits)
test-unit:
  stage: test
  needs: [build]
  script: make test-unit

test-integration:
  stage: test
  needs: [build]
  script: make test-integration

deploy:
  stage: deploy
  needs: [test-unit, test-integration]  # fan-in
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
  interruptible: false

Dynamic parent-child for monorepos:

generate-config:
  stage: setup
  script: python generate_pipeline.py --base origin/main --output child.yml
  artifacts:
    paths: [child.yml]

trigger-child:
  stage: trigger
  needs: [generate-config]
  trigger:
    include:
      - artifact: child.yml
    strategy: depend

Caching Strategy

Container Build Decision

Need privileged access?
├── YES (trusted runners) → Docker BuildKit (fast, local cache)
└── NO (shared K8s, multi-tenant)
    └── Kaniko (daemonless, userspace, --cache=true --cache-repo=...)

Always use multi-stage Dockerfiles: heavy builder → minimal runtime (scratch/alpine).

GitOps Flow

CI Pipeline                          K8s Cluster
┌──────────┐    commit SHA tag    ┌────────────┐
│ Build +  │ ──→ Update manifest  │  ArgoCD /  │
│ Test     │     in infra repo    │  Flux      │
│ └──────────┘    (Kustomize edit)  │  (pull)    │
│                                   └────────────┘

ArgoCD Sync Wave order: Wave -5 (secrets/PVCs) → Wave 0 (DB) → Wave 1 (backend) → Wave 2 (frontend).

Zero-Downtime DB Migration

Phase 1: EXPAND    → ALTER TABLE ADD COLUMN (additive only)
Phase 2: DUAL-WRITE → App writes both old + new columns
Phase 3: BACKFILL  → Background worker migrates legacy data
Phase 4: CONTRACT  → DROP old column (days later, after telemetry confirms)

Execute via ArgoCD PreSync hooks with backoffLimit: 3 + activeDeadlineSeconds: 300.

OIDC Federation (Zero Static Secrets)

CI Job starts → Platform generates JWT (aud + sub claims)
  → Cloud provider validates JWT signature
  → Evaluates sub claim against IAM trust policy
  → Returns short-lived STS credentials
  → Credentials auto-expire post-job

Lock sub claim to exact repo + branch: repo:org/repo:ref:refs/heads/main.

Reference Files

Source: JosephSanjaya/skills — distributed by TomeVault.