# Cicd Agent

> CI/CD pipeline design and review — GitHub Actions, pipeline best practices, secrets management, deployment strategies, and release automation

- **Type:** Skill
- **Install:** `agentstack add skill-chandrudp29-skillhub-cicd-agent`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [chandrudp29](https://agentstack.voostack.com/s/chandrudp29)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [chandrudp29](https://github.com/chandrudp29)
- **Source:** https://github.com/chandrudp29/skillhub/tree/main/skills/cicd-agent
- **Website:** https://pypi.org/project/skillhub-ai/

## Install

```sh
agentstack add skill-chandrudp29-skillhub-cicd-agent
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

## When to Use
Apply when writing, reviewing, or debugging CI/CD pipelines. Covers GitHub Actions primarily but principles apply to any CI system.

## Core Rules

- Every pipeline must have: lint → test → build → deploy (in that order, each blocking the next)
- Secrets never in code, YAML, or logs — use environment secrets or a secrets manager
- Pin action versions to a commit SHA, not a tag (`uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683`)
- Jobs that can run in parallel, should — don't serialize unnecessarily
- Always define a timeout for jobs — runaway jobs eat minutes/money

## GitHub Actions Structure

```yaml
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true  # cancel stale PR runs

jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: '3.12' }
      - run: pip install ruff && ruff check .

  test:
    needs: lint
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      matrix:
        python-version: ['3.10', '3.11', '3.12']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: '${{ matrix.python-version }}' }
      - run: pip install -e ".[dev]" && pytest --tb=short

  deploy:
    needs: [lint, test]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - run: ./deploy.sh
        env:
          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
```

## Secrets Management

```yaml
# Never do this:
env:
  API_KEY: "sk-abc123"  # ❌ visible in git history forever

# Do this — repository/org secrets:
env:
  API_KEY: ${{ secrets.API_KEY }}  # ✓

# For complex secrets, use a secrets manager:
- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/GithubActionsRole
    aws-region: us-east-1

- name: Get secrets from SSM
  run: |
    DB_PASSWORD=$(aws ssm get-parameter --name /prod/db/password --with-decryption --query Parameter.Value --output text)
    echo "::add-mask::$DB_PASSWORD"  # mask in logs
    echo "DB_PASSWORD=$DB_PASSWORD" >> $GITHUB_ENV
```

## Caching

```yaml
# Python dependencies
- uses: actions/cache@v4
  with:
    path: ~/.cache/pip
    key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt') }}
    restore-keys: ${{ runner.os }}-pip-

# Node modules
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
```

## Deployment Strategies

```
Blue-Green:
  Two identical environments (blue=live, green=staging)
  Deploy to green → run smoke tests → switch traffic → blue becomes new staging
  Instant rollback: switch traffic back

Canary:
  Route 5% of traffic to new version → monitor → gradually increase → 100%
  Good for: high-traffic services where you want real-traffic validation

Rolling:
  Replace instances one by one (or in batches)
  No duplicate infrastructure cost, but brief period of mixed versions

Feature flags (preferred for risk reduction):
  Deploy code to 100% → enable flag for 1% → monitor → expand
  Decouple deployment from release
```

## Release Automation

```yaml
# Auto-version on merge to main using conventional commits
- name: Semantic Release
  uses: cycjimmy/semantic-release-action@v4
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

# Python: bump version + publish to PyPI on tag
- name: Publish to PyPI
  if: startsWith(github.ref, 'refs/tags/v')
  uses: pypa/gh-action-pypi-publish@release/v1
  with:
    password: ${{ secrets.PYPI_API_TOKEN }}
```

## Pipeline Health

- Track mean pipeline duration — if it grows past 10 min, investigate
- Use `GITHUB_STEP_SUMMARY` to write markdown summaries visible in the Actions UI
- Fail fast: lint and type-check before running tests (10s vs 5 min)
- Flaky tests are a pipeline emergency — fix or quarantine within 24h

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [chandrudp29](https://github.com/chandrudp29)
- **Source:** [chandrudp29/skillhub](https://github.com/chandrudp29/skillhub)
- **License:** MIT
- **Homepage:** https://pypi.org/project/skillhub-ai/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-chandrudp29-skillhub-cicd-agent
- Seller: https://agentstack.voostack.com/s/chandrudp29
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.