cicd-generation

Files (6)

• SKILL.md
• ci-node.yml.tmpl · assets/
• ci-python.yml.tmpl · assets/
• trigger-evals.json · eval-cases/
• pin-action-versions.sh · scripts/
• validate-workflow.sh · scripts/

SKILL.md (first lines)

# CI/CD Generation Skill

Generate production-ready GitHub Actions workflows.

## Input Sanitization

- Workflow file names: alphanumeric, hyphens, and underscores only — reject `..`, shell metacharacters, or null bytes
- Action references: `owner/action@ref` format — reject shell metacharacters and null bytes
- Secret names: uppercase alphanumeric and underscores only

## Core Principles

1. **Fail-fast**: Quick checks (lint, type) before slow ops (build, test)
2. **Security hardening**: OIDC auth, minimal permissions, pinned action versions
3. **Caching**: Based on detected package manager
4. **Matrix testing**: When multiple versions/platforms needed
5. **Verification-first**: Examine repo before generating workflow

## Process

### Step 1: Analyze Repository

Before generating ANY workflow, verify:

```
[ ] Language/framework detected
[ ] Package manager identified (npm, yarn, pnpm, pip, poetry, go mod)
[ ] Test command exists and verified
[ ] Lint/format commands exist
[ ] Build output/artifacts identified
[ ] Deployment target identified (if applicable)
```

### Step 2: Workflow Structure

**Standard CI workflow** (`.github/workflows/ci.yml`):

```yaml
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup
        # Language-specific setup
      - name: Lint
        run: <lint-command>

  test:
    runs-on: ubuntu-latest
    needs: lint  # Fail-fast: lint before test
    steps:
      - uses: actions/checkout@v4
      - name: Setup
        # Language-specific setup with caching
      - name: Test
        run: <test-command>

  build:
    runs-on: ubuntu-latest
    needs: test  # Fail-fast: test before build
    steps:
      - uses: actions/checkout@v4
      - name: Setup
        # Language-specific setup
      - name: Build
        run: <build-command>
```

### Step 3: Language-Specific Patterns

**Node.js:**
```yaml
- uses: actions/setup-node@v4
  with:
    node-version: '20'
    cache: 'npm'  # or yarn, pnpm
- run: npm ci
```

**Python:**
```yaml
- uses: actions/setup-python@v5
  with:
    python-version: '3.12'
    cache: 'pip'
- run: pip install -r requirements.txt
```

**Go:**
```yaml
- uses: actions/setup-go@v5
  with:
    go-version: '1.22'
    cache: true
```

### Step 4: Security Hardening

**Required practices:**
- Pin action versions to SHA: `actions/checkout@<sha>`
- Minimal permissions block at workflow and job level
- Use OIDC for cloud deployments (no long-lived secrets)
- Never echo secrets

**OIDC example (AWS):**
```yaml
permissions:

From dtsong/claude-code-wsl-setup, MIT.