CI/CD Pipeline Generator

Purpose & When-To-Use

Trigger conditions:

• New project needs CI/CD pipeline from scratch
• Migrating between CI/CD platforms
• Standardizing pipeline configurations across projects
• Adding missing stages (security, testing) to existing pipeline
• Tech stack change requires pipeline updates

Use this skill when you need a complete, platform-optimized CI/CD pipeline configuration file with build, test, security, and deploy stages.

Pre-Checks

Before execution, verify:

1. Time normalization: NOW_ET = 2025-10-26T01:33:56-04:00 (NIST/time.gov semantics, America/New_York)
2. Input schema validation:
   • platform is one of: github-actions, gitlab-ci, jenkins, azure-devops
   • tech_stack contains valid language identifiers
   • stages object specifies at minimum: build and test configurations
3. Source freshness: All cited sources accessed on NOW_ET; verify documentation links current
4. Platform access: Confirm target platform is available and licensed

Abort conditions:

• Platform is proprietary/undocumented with no public API reference
• Tech stack language not supported by target platform
• Conflicting stage requirements (e.g., parallel and sequential for same stage)

Procedure

Tier 1 (Fast Path, ≤2k tokens)

Token budget: ≤2k tokens

Scope: Generate basic CI/CD pipeline for common tech stacks with standard build, test, and deploy stages.

Steps:

1. Analyze inputs and select template (300 tokens):

   • Determine platform format (YAML for GitHub Actions/GitLab, Groovy for Jenkins, YAML for Azure DevOps)
   • Identify language-specific runners and dependencies
   • Map stages to platform constructs (jobs, stages, steps)

2. Generate pipeline configuration (1700 tokens):

   • Build stage: Install dependencies, compile/build artifacts
   • Test stage: Run unit and integration tests with coverage
   • Security stage: SAST scan, dependency vulnerability check
   • Deploy stage: Push to registry or deploy to target environment
   • Include dependency caching for performance
   • Add matrix builds for multi-version testing if applicable
   • Output pipeline file with inline comments
   • Generate setup guide with required secrets and variables

Decision point: If requirements include multi-environment deployments, advanced security gates, or custom integrations → escalate to T2.

Tier 2 (Extended Analysis, ≤6k tokens)

Token budget: ≤6k tokens

Scope: Multi-environment pipelines with advanced security, approval gates, and performance optimization.

Steps:

1. Design multi-environment pipeline (2000 tokens):

   • Configure environment-specific stages (dev, staging, production)
   • Implement promotion gates with manual approvals
   • Add environment-specific variables and secret management
   • Configure conditional execution based on branch patterns
   • GitHub Actions (accessed 2025-10-26T01:33:56-04:00): Use environments with protection rules
   • GitLab CI (accessed 2025-10-26T01:33:56-04:00): Implement environment-specific jobs with deployment strategies
   • Jenkins (accessed 2025-10-26T01:33:56-04:00): Use input steps for approvals and parameters for environments
   • Azure DevOps (accessed 2025-10-26T01:33:56-04:00): Configure deployment stages with approval gates

2. Generate optimized configuration (4000 tokens):

   • Advanced caching strategies (layer caching, dependency caching, build caching)
   • Parallel job execution for independent stages
   • Security hardening:
     • SAST with SonarQube or Semgrep
     • SCA with Snyk or Dependabot integration
     • Secret scanning with git-secrets or TruffleHog
     • Container image scanning with Trivy
   • Testing integration:
     • Unit, integration, and e2e test suites
     • Code coverage reporting with quality gates (minimum 80%)
     • Performance benchmarking
   • Artifact management:
     • Build artifact storage and versioning
     • Container image tagging strategies
     • Retention policies
   • Notifications and reporting:
     • Slack/Teams notifications for failures
     • Status badges and dashboards
     • Metrics collection (build time, success rate)

Sources cited (accessed 2025-10-26T01:33:56-04:00):

• GitHub Actions: https://docs.github.com/en/actions/deployment/targeting-different-environments
• GitLab CI/CD: https://docs.gitlab.com/ee/ci/yaml/
• Jenkins Pipeline: https://www.jenkins.io/doc/book/pipeline/syntax/
• Azure DevOps Pipelines: https://learn.microsoft.com/en-us/azure/devops/pipelines/

Tier 3 (Deep Dive, ≤12k tokens)

Token budget: ≤12k tokens

Scope: Enterprise-grade pipelines with compliance automation, custom plugins, and advanced orchestration.

Steps:

1. Enterprise compliance integration (4000 tokens):

   • Policy-as-code validation (OPA, Sentinel) in pipeline
   • Compliance artifact generation (SBOM, attestations, audit logs)
   • Regulatory gate enforcement (SOC2, HIPAA, FedRAMP requirements)
   • Signed commits and artifact signing with Cosign/Sigstore

2. Advanced orchestration (4000 tokens):

   • Cross-pipeline dependencies and triggers
   • Dynamic pipeline generation based on repository changes
   • Custom plugin/action development for specialized tasks
   • Pipeline-as-code templating and reusability patterns
   • Multi-repository coordination (monorepo strategies)

3. Performance and reliability optimization (4000 tokens):

   • Pipeline performance profiling and bottleneck analysis
   • Retry logic and failure recovery strategies
   • Resource optimization (runner sizing, autoscaling)
   • Pipeline observability (metrics, logs, traces)
   • Chaos engineering for pipeline resilience testing

Additional sources (accessed 2025-10-26T01:33:56-04:00):

• SLSA Framework: https://slsa.dev/spec/v1.0/
• Sigstore: https://www.sigstore.dev/
• OWASP CI/CD Security: https://owasp.org/www-project-top-10-ci-cd-security-risks/

Decision Rules

Platform selection guidance:

• GitHub Actions: GitHub-hosted projects, generous free tier, extensive marketplace
• GitLab CI: GitLab projects, integrated security scanning, robust Kubernetes support
• Jenkins: On-premise requirements, maximum flexibility, legacy system integration
• Azure DevOps: Microsoft ecosystem, enterprise compliance features

Stage configuration:

• Build: Always include dependency locking and caching
• Test: Fail fast on test failures; generate coverage reports
• Security: Block on critical vulnerabilities; allow warnings
• Deploy: Require manual approval for production

Escalation conditions:

• Custom compliance requirements not covered by standard tools
• Novel platform or unsupported tech stack combination
• Requirements exceed T3 scope (multi-cloud orchestration, custom tooling development)

Abort conditions:

• Platform limitations prevent required security controls
• Missing critical information and stakeholder unavailable
• Conflicting requirements (e.g., "zero approval gates" with "manual production approval")

Output Contract

Required outputs:

{
  "pipeline_config": {
    "type": "object",
    "properties": {
      "platform": "string (github-actions|gitlab-ci|jenkins|azure-devops)",
      "file_path": "string (.github/workflows/ci.yml, .gitlab-ci.yml, Jenkinsfile)",
      "content": "string (complete pipeline configuration)",
      "language": "string (yaml|groovy)"
    }
  },
  "setup_guide": {
    "type": "markdown",
    "properties": {
      "secrets_required": ["array of secret names and descriptions"],
      "variables_required": ["array of variable names and defaults"],
      "setup_steps": "string (step-by-step setup instructions)"
    }
  }
}

Quality guarantees:

• Pipeline configuration is syntactically valid for target platform
• All secrets referenced but never hardcoded
• Required stages (build, test) are present and properly configured
• Caching is enabled for dependencies to improve performance
• Error handling and failure notifications configured

Examples

Example: GitHub Actions pipeline for Node.js application

# .github/workflows/ci.yml
name: CI Pipeline
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm run lint
      - run: npm test -- --coverage
      - run: npm run build

  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          severity: 'CRITICAL,HIGH'

Quality Gates

Token budgets:

• T1: ≤2k tokens (basic single-environment pipeline)
• T2: ≤6k tokens (multi-environment with advanced security)
• T3: ≤12k tokens (enterprise compliance and orchestration)

Safety checks:

• No hardcoded secrets in generated configurations
• All external actions/dependencies pinned to specific versions
• Security scanning stages fail on critical vulnerabilities
• Minimum test coverage threshold enforced

Auditability:

• All pipeline runs logged with timestamps and triggering actor
• Approval gates record approver identity
• Generated configurations include inline documentation

Determinism:

• Same inputs produce identical pipeline configuration
• Dependency versions locked (package-lock.json, requirements.txt)
• Build environments use versioned base images

Resources

Official Documentation (accessed 2025-10-26T01:33:56-04:00):

• GitHub Actions: https://docs.github.com/en/actions
• GitLab CI/CD: https://docs.gitlab.com/ee/ci/
• Jenkins Documentation: https://www.jenkins.io/doc/
• Azure DevOps Pipelines: https://learn.microsoft.com/en-us/azure/devops/pipelines/

Best Practices (accessed 2025-10-26T01:33:56-04:00):

• DORA Metrics: https://dora.dev/research/
• CI/CD Security: https://owasp.org/www-project-top-10-ci-cd-security-risks/
• Software Supply Chain: https://slsa.dev/

Templates (in repository /resources/):

• GitHub Actions templates for Python, Node.js, Go, Java
• GitLab CI templates with security scanning
• Jenkins declarative pipeline examples