CI/CD Skill
Build production-grade CI/CD pipelines — from GitHub Actions workflows to self-hosted runners and zero-downtime deployment strategies.
RULE: Show complete workflow YAML and explain each job before generating. Wait for GO.
🚧 Status: Stub — implementation pending
This reference skill has the structure but the snippet content is still being filled in
(you'll see <!-- TODO --> placeholders below). It activates and tells Claude the topic
exists, but won't yield deep snippets yet.
Want to help? Pick any TODO, write the snippet, open a PR. See CONTRIBUTING.md.
Each contribution moves the skill closer to "Ready" status.
Capabilities
GitHub Actions Workflows
Self-Hosted Runner Setup
Docker Build & Push Pipeline
Multi-Environment Deployments
Secrets Management in CI
Rollback Strategies
Starter Workflows
Node.js CI + ECR Push + EKS Deploy
name: Deploy
on:
push:
branches: [main]
permissions:
id-token: write # OIDC
contents: read
jobs:
build-and-deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Configure AWS via OIDC
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::[account]:role/github-actions-role
aws-region: [region]
- name: Login to ECR
uses: aws-actions/amazon-ecr-login@v2
- name: Build & push
run: |
docker build -t $ECR_REGISTRY/$ECR_REPO:${{ github.sha }} .
docker push $ECR_REGISTRY/$ECR_REPO:${{ github.sha }}
env:
ECR_REGISTRY: [account].dkr.ecr.[region].amazonaws.com
ECR_REPO: [app-name]
- name: Deploy to EKS
run: |
aws eks update-kubeconfig --name [cluster] --region [region]
helm upgrade --install [app] helm/[app] \
--set image.tag=${{ github.sha }} \
--values helm/[app]/values-prod.yaml \
--namespace [ns] --wait
Rollback Job
rollback:
runs-on: ubuntu-latest
needs: [build-and-deploy]
if: failure()
steps:
- name: Rollback Helm release
run: |
aws eks update-kubeconfig --name [cluster] --region [region]
helm rollback [app] 0 --namespace [ns] # 0 = previous revision
1---2name: cicd3description: CI/CD pipeline builder — GitHub Actions, self-hosted runners, Docker build/push, multi-environment deployments, secrets, rollback strategies4---56# CI/CD Skill78Build production-grade CI/CD pipelines — from GitHub Actions workflows to self-hosted runners and zero-downtime deployment strategies.910**RULE: Show complete workflow YAML and explain each job before generating. Wait for GO.**1112> **🚧 Status: Stub — implementation pending**13>14> This reference skill has the structure but the snippet content is still being filled in15> (you'll see `<!-- TODO -->` placeholders below). It activates and tells Claude the topic16> exists, but won't yield deep snippets yet.17>18> **Want to help?** Pick any TODO, write the snippet, open a PR. See [CONTRIBUTING.md](../../CONTRIBUTING.md).19> Each contribution moves the skill closer to "Ready" status.2021---2223## Capabilities2425### GitHub Actions Workflows26<!-- TODO: Workflow triggers, reusable workflows, composite actions -->27<!-- TODO: Matrix builds, concurrency groups, path filters -->28<!-- TODO: Caching strategies (npm, pip, docker layers) -->2930### Self-Hosted Runner Setup31<!-- TODO: Runner installation on Ubuntu, runner groups -->32<!-- TODO: Docker-based runner, ephemeral runners on EKS -->33<!-- TODO: Security hardening for self-hosted runners -->3435### Docker Build & Push Pipeline36<!-- TODO: Multi-platform builds (amd64/arm64), BuildKit cache -->37<!-- TODO: ECR push, GHCR push, tagging strategies (sha, semver, latest) -->38<!-- TODO: Vulnerability scanning in pipeline (Trivy, Snyk) -->3940### Multi-Environment Deployments41<!-- TODO: dev → staging → prod promotion flow -->42<!-- TODO: Environment protection rules, required reviewers -->43<!-- TODO: Helm upgrade in pipeline, kubectl apply, ArgoCD sync -->4445### Secrets Management in CI46<!-- TODO: GitHub Actions secrets, OIDC to AWS (no long-lived keys) -->47<!-- TODO: Secrets injection into Docker build args vs runtime env -->48<!-- TODO: Rotate secrets without pipeline downtime -->4950### Rollback Strategies51<!-- TODO: Helm rollback in pipeline, ArgoCD rollback -->52<!-- TODO: Blue/green switch rollback, database migration rollback -->53<!-- TODO: Automated rollback on health check failure -->5455---5657## Starter Workflows5859### Node.js CI + ECR Push + EKS Deploy60```yaml61name: Deploy62on:63 push:64 branches: [main]6566permissions:67 id-token: write # OIDC68 contents: read6970jobs:71 build-and-deploy:72 runs-on: ubuntu-latest73 steps:74 - uses: actions/checkout@v47576 - name: Configure AWS via OIDC77 uses: aws-actions/configure-aws-credentials@v478 with:79 role-to-assume: arn:aws:iam::[account]:role/github-actions-role80 aws-region: [region]8182 - name: Login to ECR83 uses: aws-actions/amazon-ecr-login@v28485 - name: Build & push86 run: |87 docker build -t $ECR_REGISTRY/$ECR_REPO:${{ github.sha }} .88 docker push $ECR_REGISTRY/$ECR_REPO:${{ github.sha }}89 env:90 ECR_REGISTRY: [account].dkr.ecr.[region].amazonaws.com91 ECR_REPO: [app-name]9293 - name: Deploy to EKS94 run: |95 aws eks update-kubeconfig --name [cluster] --region [region]96 helm upgrade --install [app] helm/[app] \97 --set image.tag=${{ github.sha }} \98 --values helm/[app]/values-prod.yaml \99 --namespace [ns] --wait100```101102### Rollback Job103```yaml104 rollback:105 runs-on: ubuntu-latest106 needs: [build-and-deploy]107 if: failure()108 steps:109 - name: Rollback Helm release110 run: |111 aws eks update-kubeconfig --name [cluster] --region [region]112 helm rollback [app] 0 --namespace [ns] # 0 = previous revision113```114115<!-- TODO: Add full interactive workflow builder for each capability above -->