ci-cd-conformance
Skill4 starsChanged 10 months agoMITView on GitHub
Use when user creates/modifies CI/CD pipelines, mentions deployment automation, quality gates, or release processes. Applies to all repositories by default to ensure platform-specific best practices (dependency scanning, secret detection, protected branches).
In this repository67 other files it gives its agents.
- AGENTS.mdAGENTS.md
- CLAUDE.mdCLAUDE.md
- agents-onboardingSkill
- agent-workitem-automationSkill
- architecture-testingSkill
- aspire-integration-testingSkill
- automated-standards-enforcementSkill
- best-practice-introductionSkill
- branching-strategy-and-conventionsSkill
- broken-windowSkill
- change-risk-rollbackSkill
- component-boundary-ownershipSkill
- contract-consistency-validationSkill
- csharp-best-practicesSkill
- deployment-provenanceSkill
- documentation-as-codeSkill
- documentation-scaffoldSkill
- dotnet-bespoke-code-minimisationSkill
- dotnet-best-practicesSkill
- dotnet-domain-primitivesSkill
- dotnet-efcore-practicesSkill
- dotnet-healthchecksSkill
- dotnet-logging-serilogSkill
- dotnet-mapping-standardSkill
- dotnet-open-source-first-governanceSkill
- dotnet-source-generation-firstSkill
- dotnet-specification-patternSkill
- dotnet-testing-assertionsSkill
- environment-traceabilitySkill
- finishing-a-development-branch-iddSkill
- greenfield-baselineSkill
- impacted-scope-enforcementSkill
- incremental-change-impactSkill
- incremental-deploymentSkill
- innersource-governance-bootstrapSkill
- issue-driven-deliverySkill
- library-extraction-stabilisationSkill
- local-dev-experienceSkill
- markdown-authorSkill
- modern-csharp-coding-standardsSkill
- monorepo-orchestration-setupSkill
- observability-logging-baselineSkill
- pair-programmingSkill
- persona-switchingSkill
- process-skill-routerSkill
- quality-gate-enforcementSkill
- release-tagging-planSkill
- repo-best-practices-bootstrapSkill
- repository-foundation-bootstrapSkill
- requirements-gatheringSkill
- runtime-tooling-validationSkill
- safe-brownfield-refactorSkill
- scoped-colocationSkill
- security-processesSkill
- selective-build-testSkill
- semantic-version-impactSkill
- session-awareSkill
- skills-first-workflowSkill
- static-analysis-securitySkill
- structured-review-workflowSkill
- The first 60 shown.
The file
We split this skill into the rules it gives an agent
3 rules. About 0 are common, 2 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈2
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 35
Document pipeline in docs/ci-cd-pipeline.md
- Distinctive: line 36
Add status badge and summary to README.md
- Distinctive: line 57
All of these mean: Apply skill.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
CI/CD Conformance
Overview
P1 Quality & Correctness - Enforces quality gates, immutable releases, and platform security features. Prevents defective deployments.
REQUIRED: superpowers:verification-before-completion, superpowers:brainstorming
When to Use
- Creating/modifying CI/CD pipelines
- Deployment automation, quality gates, release processes
- Default: Applies to all repositories
- Opt-out: User explicitly refuses
Core Workflow
- Detect CI/CD provider (GitHub Actions, Azure Pipelines, GitLab CI, Jenkins)
- Prompt CLI install if missing (gh, az, glab)
- Announce skill application
- Configure quality gates: tests, linting, security scan, coverage threshold
- Configure immutable releases: tag-triggered deployments only
- Configure incremental execution: caching, conditional jobs
- Enable platform security: dependency scanning, secret detection, branch protection
- Configure OIDC/managed identity (eliminate long-lived secrets)
- Document pipeline in docs/ci-cd-pipeline.md
- Add status badge and summary to README.md
Quick Reference
| Provider | CLI | Security Features |
| GitHub Actions | gh | Dependabot, CodeQL, secret scanning, OIDC |
| Azure Pipelines | az | Advanced security, credential scanning |
| GitLab CI | glab | SAST, DAST, dependency scanning |
| Jenkins | jenkins | Plugin-based security |
See Provider Configuration for setup details.
Red Flags - STOP
- "Can add quality gates later"
- "Security scanning not needed"
- "Just need basic deployment"
- "Branch protection is extra"
- "Existing pipeline is fine"
All of these mean: Apply skill. CI/CD without quality gates is deployment automation, not CI/CD.
Rationalizations
| Excuse | Reality |
| "Can add quality gates after demo" | Demo deploys become production. Quality gates prevent defects. |
| "Customer doesn't care about scanning" | Data breaches affect all customers. Security is non-negotiable. |
| "Branch protection is separate" | CI/CD setup includes security. Incomplete setup creates risk. |
| "Existing pipeline has worked" | Lack of gates accumulates technical debt. |
| "Migration risk not worth it" | Risk of NOT having gates exceeds migration risk. |
See Brownfield Migration for incremental approaches.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.