Ci Cd Audit

CI/CD Audit

Overview

Deployment should be boring. If deploying is scary, your pipeline is broken.

Core principle: Every deploy should be automated, tested, reversible, and auditable.

The Iron Law

NO MANUAL DEPLOYMENT STEPS. NO DEPLOY WITHOUT AUTOMATED TESTS. NO DEPLOY WITHOUT ROLLBACK PLAN. NO SECRETS IN SOURCE CODE.

When to Use

• Setting up or reviewing CI/CD pipelines
• After a failed deployment
• Before first production deploy
• When deployment takes too long or fails too often
• When different environments behave differently
• During any codebase audit

When NOT to Use

• Personal scripts or local dev tooling (not deployment)
• Evaluating which CI platform to choose (this audits existing pipelines)
• Library/package projects with no deployment (use dependency-audit)

Anti-Shortcut Rules

YOU CANNOT:
- Say "pipeline looks fine" — read every stage, every config file, every env var
- Say "tests run in CI" — verify they BLOCK deployment on failure (not just advisory)
- Say "we have staging" — verify staging matches production config structure
- Say "rollback works" — verify the procedure is documented AND tested
- Say "secrets are secure" — grep the repo for hardcoded values
- Skip checking deployment logs — read the last 5 deployments for warnings
- Assume environment parity — check runtime versions, deps, config in each env

Common Rationalizations (Don't Accept These)

| Rationalization | Reality | |----------------|---------| | "We deploy manually because it's faster" | Manual deploys are faster until they fail. Then it's a 4-hour incident. | | "We don't need staging" | Local ≠ production. Network, DNS, config, secrets, scale differ. | | "Tests slow down the pipeline" | Slow tests = testing problem. Fix tests, don't skip them. | | "We've never needed to rollback" | You haven't needed to rollback YET. When you do, 5 min vs 5 hours matters. | | "We deploy from our laptops" | One compromised laptop = compromised production. Deploy from CI only. | | "Friday deploys are fine" | If they require bravery, your pipeline lacks confidence signals. |

Iron Questions

1. If a broken commit hits main, what stops it from reaching production?
2. Can you rollback in under 5 minutes?
3. Can you deploy a hotfix in under 15 minutes?
4. What's the blast radius of a bad deploy?
5. If CI goes down, can you deploy in an emergency?
6. Who can deploy to production? Is there approval?
7. Are there ANY manual steps? Including database migrations?
8. Can you reproduce any past deployment exactly?
9. What happens if two people deploy simultaneously?
10. How long from merged PR to running in production?

The Audit Process

Phase 1: Build Pipeline

1. IS the build automated? (triggered on push/PR/tag)
2. IS the build reproducible? (same commit → same artifact)
3. DOES it fail fast? (lint → types → unit → integration → e2e)
4. IS build time reasonable? ( 6 months |
| Lead time |  6 months |
| MTTR |  6 months |
| Change failure rate | 0-15% | 16-30% | 31-45% | 46-60% |

## Output Format

```markdown
# CI/CD Audit: [Project Name]

## Pipeline Overview
- **CI Platform:** [GitHub Actions / GitLab CI / etc.]
- **Environments:** [List]
- **Deploy Frequency:** [Per day/week/month]
- **Build Time:** [X minutes]
- **Rollback Time:** [X minutes / untested]
- **Strategy:** [Rolling / Blue-green / Canary]

## Pipeline Stages
| Stage | Automated | Blocking | Cached | Duration |
|-------|-----------|----------|--------|----------|

## DORA Metrics Assessment
[Current vs target]

## Findings
[Standard severity format]

## Verdict: [PASS / CONDITIONAL PASS / FAIL]

Red Flags

• Manual deployment (SSH + git pull + restart)
• Tests not required before merge
• No staging environment
• Secrets in source code or git history
• No rollback plan
• Deploy takes > 30 minutes
• No health check after deploy
• Only one person knows how to deploy
• No deploy notifications

Integration

• Part of: Full audit with architecture-audit
• Complements: security-audit for secrets and deploy security
• Enables: incident-response rollback procedures
• Informs: observability-audit for deploy markers

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: boparaiamrit
• Source: boparaiamrit/skills-by-amrit
• License: MIT

Install and usage instructions live in the source repository linked above.