building-ci-pipelines

Name: building-ci-pipelines
Author: ancoleman

52installs59forks

How to install building-ci-pipelines?

ancoleman/ai-design-components/building-ci-pipelines

$npx -y skills add ancoleman/ai-design-components --skill building-ci-pipelines

Installs into the current project.

Summary

Constructs secure, efficient CI/CD pipelines with supply chain security (SLSA), monorepo optimization, caching strategies, and parallelization patterns for GitHub Actions, GitLab CI, and Argo Workflows. Use when setting up automated testing, building, or deployment workflows.

Files · 1

View on GitHub

SKILL.md

1	# Building CI Pipelines
2
3	## Purpose
4
5	CI/CD pipelines automate testing, building, and deploying software. This skill provides patterns for constructing robust, secure, and efficient pipelines across GitHub Actions, GitLab CI, Argo Workflows, and Jenkins. Focus areas: supply chain security (SLSA), monorepo optimization, caching, and parallelization.
6
7	## When to Use This Skill
8
9	Invoke when:
10	- Setting up continuous integration for new projects
11	- Implementing automated testing workflows
12	- Building container images with security provenance
13	- Optimizing slow CI pipelines (especially monorepos)
14	- Implementing SLSA supply chain security
15	- Configuring multi-platform builds
16	- Setting up GitOps automation
17	- Migrating from legacy CI systems
18
19	## Platform Selection
20
21	GitHub-hosted → GitHub Actions (SLSA native, 10K+ actions, OIDC)
22	GitLab-hosted → GitLab CI (parent-child pipelines, built-in security)
23	Kubernetes → Argo Workflows (DAG-based, event-driven)
24	Legacy → Jenkins (migrate when possible)
25
26	### Platform Comparison
27
28	\| Feature \| GitHub Actions \| GitLab CI \| Argo \| Jenkins \|
29	\|---------\|---------------\|-----------\|------\|---------\|
30	\| Ease of Use \| ⭐⭐⭐⭐⭐ \| ⭐⭐⭐⭐ \| ⭐⭐⭐ \| ⭐⭐ \|
31	\| SLSA \| Native \| Manual \| Good \| Manual \|
32	\| Monorepo \| Good \| Excellent \| Manual \| Plugins \|
33
34	## Quick Start Patterns
35
36	### Pattern 1: Basic CI (Lint → Test → Build)
37
38	```yaml
39	# GitHub Actions
40	name: CI
41	on: [push, pull_request]
42
43	jobs:
44	lint:
45	runs-on: ubuntu-latest
46	steps:
47	- uses: actions/checkout@v4
48	- run: npm run lint
49
50	test:
51	needs: lint
52	runs-on: ubuntu-latest
53	steps:
54	- uses: actions/checkout@v4
55	- run: npm test
56
57	build:
58	needs: test
59	runs-on: ubuntu-latest
60	steps:
61	- uses: actions/checkout@v4
62	- run: npm run build
63	```
64
65	### Pattern 2: Matrix Strategy (Multi-Platform)
66
67	```yaml
68	test:
69	runs-on: ${{ matrix.os }}
70	strategy:
71	matrix:
72	os: [ubuntu-latest, windows-latest, macos-latest]
73	node-version: [18, 20, 22]
74	steps:
75	- uses: actions/checkout@v4
76	- uses: actions/setup-node@v4
77	with:
78	node-version: ${{ matrix.node-version }}
79	- run: npm test
80	```
81
82	9 jobs (3 OS × 3 versions) in parallel: 5 min vs 45 min sequential.
83
84	### Pattern 3: Monorepo Affected (Turborepo)
85
86	```yaml
87	build:
88	runs-on: ubuntu-latest
89	steps:
90	- uses: actions/checkout@v4
91	with:
92	fetch-depth: 0 # Required for affected detection
93
94	- uses: actions/setup-node@v4
95	with:
96	node-version: 20
97
98	- name: Build affected
99	run: npx turbo run build --filter='...[origin/main]'
100	env:
101	TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
102	TURBO_TEAM: ${{ vars.TURBO_TEAM }}
103	```
104
105	60-80% CI time reduction for monorepos.
106
107	### Pattern 4: SLSA Level 3 Provenance
108
109	```yaml
110	name: SLSA Build
111	on:
112	push:
113	tags: ['v*']
114
115	permissions:
116	id-token: write
117	contents: read
118	packages: write
119
120	jobs:
121	build:
122	runs-on: ubuntu-latest
123	outputs:
124	digest: ${{ steps.build.outputs.digest }}
125	steps:
126	- uses: actions/checkout@v4
127	- name: Build container
128	id: build
129	uses: docker/build-push-action@v5
130	with:
131	push: true
132	tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
133
134	provenance:
135	needs: build
136	permissions:
137	id-token: write
138	actions: read
139	packages: write
140	uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.10.0
141	with:
142	image: ghcr.io/${{ github.repository }}
143	digest: ${{ needs.build.outputs.digest }}
144	registry-username: ${{ github.actor }}
145	secrets:
146	registry-password: ${{ secrets.GITHUB_TOKEN }}
147	```
148
149	Verification:
150	```bash
151	cosign verify-attestation --type slsaprovenance \
152	--certificate-identity-regexp "^https://github.com/slsa-framework" \
153	--certificate-oidc-issuer https://token.actions.githubusercontent.com \
154	ghcr.io/myorg/myapp@sha256:abcd...
155	```
156
157	### Pattern 5: OIDC Federation (No Credentials)
158
159	```yaml
160	deploy:
161	runs-on: ubuntu-latest
162	permissions:
163	id-token: write
164	contents: read
165	steps:
166	- uses: actions/checkout@v4
167
168	- name: Configure AWS credentials
169	uses: aws-actions/configure-aws-credentials@v4
170	with:
171	role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsRole
172	aws-region: us-east-1
173
174	- name: Deploy
175	run: aws s3 sync ./dist s3://my-bucket
176	```
177
178	Benefits: No stored credentials, 1-hour lifetime, full audit trail.
179
180	### Pattern 6: Security Scanning
181
182	```yaml
183	security:
184	runs-on: ubuntu-latest
185	steps:
186	- uses: actions/checkout@v4
187	with:
188	fetch-depth: 0
189
190	- name: Gitleaks (secret detection)
191	uses: gitleaks/gitleaks-acti

People who liked this also viewed

6 picks

Type

building-ci-pipelines

52installs59forks

View on GitHub

How to install building-ci-pipelines?

ancoleman/ai-design-components/building-ci-pipelines

$npx -y skills add ancoleman/ai-design-components --skill building-ci-pipelines

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Building CI Pipelines
2
3	## Purpose
4
5	CI/CD pipelines automate testing, building, and deploying software. This skill provides patterns for constructing robust, secure, and efficient pipelines across GitHub Actions, GitLab CI, Argo Workflows, and Jenkins. Focus areas: supply chain security (SLSA), monorepo optimization, caching, and parallelization.
6
7	## When to Use This Skill
8
9	Invoke when:
10	- Setting up continuous integration for new projects
11	- Implementing automated testing workflows
12	- Building container images with security provenance
13	- Optimizing slow CI pipelines (especially monorepos)
14	- Implementing SLSA supply chain security
15	- Configuring multi-platform builds
16	- Setting up GitOps automation
17	- Migrating from legacy CI systems
18
19	## Platform Selection
20
21	GitHub-hosted → GitHub Actions (SLSA native, 10K+ actions, OIDC)
22	GitLab-hosted → GitLab CI (parent-child pipelines, built-in security)
23	Kubernetes → Argo Workflows (DAG-based, event-driven)
24	Legacy → Jenkins (migrate when possible)
25
26	### Platform Comparison
27
28	\| Feature \| GitHub Actions \| GitLab CI \| Argo \| Jenkins \|
29	\|---------\|---------------\|-----------\|------\|---------\|
30	\| Ease of Use \| ⭐⭐⭐⭐⭐ \| ⭐⭐⭐⭐ \| ⭐⭐⭐ \| ⭐⭐ \|
31	\| SLSA \| Native \| Manual \| Good \| Manual \|
32	\| Monorepo \| Good \| Excellent \| Manual \| Plugins \|
33
34	## Quick Start Patterns
35
36	### Pattern 1: Basic CI (Lint → Test → Build)
37
38	```yaml
39	# GitHub Actions
40	name: CI
41	on: [push, pull_request]
42
43	jobs:
44	lint:
45	runs-on: ubuntu-latest
46	steps:
47	- uses: actions/checkout@v4
48	- run: npm run lint
49
50	test:
51	needs: lint
52	runs-on: ubuntu-latest
53	steps:
54	- uses: actions/checkout@v4
55	- run: npm test
56
57	build:
58	needs: test
59	runs-on: ubuntu-latest
60	steps:
61	- uses: actions/checkout@v4
62	- run: npm run build
63	```
64
65	### Pattern 2: Matrix Strategy (Multi-Platform)
66
67	```yaml
68	test:
69	runs-on: ${{ matrix.os }}
70	strategy:
71	matrix:
72	os: [ubuntu-latest, windows-latest, macos-latest]
73	node-version: [18, 20, 22]
74	steps:
75	- uses: actions/checkout@v4
76	- uses: actions/setup-node@v4
77	with:
78	node-version: ${{ matrix.node-version }}
79	- run: npm test
80	```
81
82	9 jobs (3 OS × 3 versions) in parallel: 5 min vs 45 min sequential.
83
84	### Pattern 3: Monorepo Affected (Turborepo)
85
86	```yaml
87	build:
88	runs-on: ubuntu-latest
89	steps:
90	- uses: actions/checkout@v4
91	with:
92	fetch-depth: 0 # Required for affected detection
93
94	- uses: actions/setup-node@v4
95	with:
96	node-version: 20
97
98	- name: Build affected
99	run: npx turbo run build --filter='...[origin/main]'
100	env:
101	TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
102	TURBO_TEAM: ${{ vars.TURBO_TEAM }}
103	```
104
105	60-80% CI time reduction for monorepos.
106
107	### Pattern 4: SLSA Level 3 Provenance
108
109	```yaml
110	name: SLSA Build
111	on:
112	push:
113	tags: ['v*']
114
115	permissions:
116	id-token: write
117	contents: read
118	packages: write
119
120	jobs:
121	build:
122	runs-on: ubuntu-latest
123	outputs:
124	digest: ${{ steps.build.outputs.digest }}
125	steps:
126	- uses: actions/checkout@v4
127	- name: Build container
128	id: build
129	uses: docker/build-push-action@v5
130	with:
131	push: true
132	tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
133
134	provenance:
135	needs: build
136	permissions:
137	id-token: write
138	actions: read
139	packages: write
140	uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.10.0
141	with:
142	image: ghcr.io/${{ github.repository }}
143	digest: ${{ needs.build.outputs.digest }}
144	registry-username: ${{ github.actor }}
145	secrets:
146	registry-password: ${{ secrets.GITHUB_TOKEN }}
147	```
148
149	Verification:
150	```bash
151	cosign verify-attestation --type slsaprovenance \
152	--certificate-identity-regexp "^https://github.com/slsa-framework" \
153	--certificate-oidc-issuer https://token.actions.githubusercontent.com \
154	ghcr.io/myorg/myapp@sha256:abcd...
155	```
156
157	### Pattern 5: OIDC Federation (No Credentials)
158
159	```yaml
160	deploy:
161	runs-on: ubuntu-latest
162	permissions:
163	id-token: write
164	contents: read
165	steps:
166	- uses: actions/checkout@v4
167
168	- name: Configure AWS credentials
169	uses: aws-actions/configure-aws-credentials@v4
170	with:
171	role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsRole
172	aws-region: us-east-1
173
174	- name: Deploy
175	run: aws s3 sync ./dist s3://my-bucket
176	```
177
178	Benefits: No stored credentials, 1-hour lifetime, full audit trail.
179
180	### Pattern 6: Security Scanning
181
182	```yaml
183	security:
184	runs-on: ubuntu-latest
185	steps:
186	- uses: actions/checkout@v4
187	with:
188	fetch-depth: 0
189
190	- name: Gitleaks (secret detection)
191	uses: gitleaks/gitleaks-acti

People who liked this also viewed

6 picks

Type