Aller au contenu principal

Skill: ops-ci

Inline

CI/CD pipeline configuration. Trigger when the user wants to configure GitHub Actions, GitLab CI, or automate deployments.

Configuration​

PropertyValue
Contextinline
Pre-approved toolsNone declared: the project's permission settings apply
Triggermanual only — run /ops-ci

Detailed description​

CI/CD Pipeline

GitHub Actions​

name: CI/CD

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

# Least privilege by default; a job asks for more only where it needs it.
permissions:
  contents: read

# Major tags keep the example readable. In a real pipeline, pin each action to a
# full commit SHA (`uses: actions/checkout@<40-char sha> # v7.0.1`): a tag can be moved.
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: '24'
          cache: 'npm'
      - run: npm ci
      - run: npm run lint

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: '24'
          cache: 'npm'
      - run: npm ci
      - run: npm test -- --coverage
      - uses: codecov/codecov-action@v7
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  build:
    needs: [lint, test]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write   # push to ghcr.io
    steps:
      - uses: actions/checkout@v7
      - uses: docker/login-action@v4
        if: github.ref == 'refs/heads/main'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v7
        with:
          push: ${{ github.ref == 'refs/heads/main' }}
          # ghcr.io wants a lowercase name: lowercase it if the owner or repo has capitals
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

  deploy:
    needs: build
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Deploy
        env:
          DEPLOY_WEBHOOK: ${{ secrets.DEPLOY_WEBHOOK }}
        run: curl --fail -X POST "$DEPLOY_WEBHOOK"
  1. Lint - Code verification
  2. Test - Unit and integration tests
  3. Build - Artifact construction
  4. Deploy - Deployment by environment

Best practices​

  • Dependency caching
  • Parallel jobs when possible
  • Environments for security
  • Secrets for credentials
  • Branch protection rules

See also​

GitHub's own github-actions-hardening skill (github/awesome-copilot, MIT, pin 143a3d97) goes deeper on workflow security: token permissions, pinning actions by SHA, untrusted input in run:, pull_request_target. It does not generate pipelines and does not cover GitLab — authoring stays here.

Manual invocation only​

This skill carries disable-model-invocation: true, so Claude cannot load it — not when keywords match, and not from inside the same-named command either. Start it yourself with /ops-ci.

Context inline​

Inline means the skill runs in the conversation (the default, no context key):

  • Sees the full history
  • Its work is visible as it happens
  • Right for almost every skill

Practical examples​

1. Example: GitHub Actions CI/CD Pipeline​

Example: GitHub Actions CI/CD Pipeline

Scenario​

A Node.js API needs a complete CI/CD pipeline: lint, test, build, and deploy to staging/production.

Pipeline Configuration​

# .github/workflows/ci-cd.yml
name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  NODE_VERSION: '24'

jobs:
  lint-and-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci
      - run: npm run lint
      - run: npm run typecheck
      - run: npm test -- --coverage
      - uses: actions/upload-artifact@v7
        with:
          name: coverage
          path: coverage/lcov.info

  build:
    needs: lint-and-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci
      - run: npm run build
      - uses: actions/upload-artifact@v7
        with:
          name: dist
          path: dist/

  deploy-staging:
    needs: build
    if: github.ref == 'refs/heads/develop'
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/download-artifact@v7
        with:
          name: dist
      - run: echo "Deploy to staging environment"
        # Replace with actual deploy command

  deploy-production:
    needs: build
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/download-artifact@v7
        with:
          name: dist
      - run: echo "Deploy to production environment"
        # Replace with actual deploy command

Key Decisions​

  • Cache npm: actions/setup-node with cache: 'npm' speeds up installs
  • Job dependencies: build waits for lint-and-test to pass
  • Environment gates: environment: production enables manual approval
  • Artifacts: Build output shared between jobs via upload-artifact
  • Branch strategy: PRs trigger tests only, merges trigger deploy

See also​