What problem does it solve? CI/CD pipelines often ship with broad permissions, mutable dependencies, untested artifacts, and no release evidence, creating security and reliability risks. This Skill provides structured guidance for building, reviewing, and fixing continuous integration and delivery workflows so the safest path becomes the default. ## Core Features & Use Cases - Pipeline Guardrails: Enforces build-once-test-then-deploy patterns, least-privilege workflow permissions, and separation of untrusted PR validation from trusted deployment jobs. - Supply Chain Hardening: Covers pinned actions and images, SLSA-style provenance attestations, short-lived OIDC credentials, and protection against running untrusted code with secrets. - Review Checklist & Decision Rubric: Provides concrete criteria for triggers, artifacts, permissions, evidence, and rollback paths when auditing existing workflows. - Use Case: When reviewing a GitHub Actions workflow that deploys to production, use this Skill to verify the deploy job uses the exact tested artifact, has minimal permissions, and records release evidence. ## Quick Start Review my GitHub Actions deployment workflow for permission, artifact, and supply-chain issues using the platform-ci-cd guidance.
