Cli Forge Pipeline

> Optimization: This skill uses on-demand loading. Heavy content lives in references/ and is loaded only when needed.

> Language rule: Skill instructions are written in English. When generating user-facing output (reports, files, documentation), detect the project's primary language (from README, comments, docs, commit messages) and produce the output in that language. If the project is bilingual, ask the user which language to use before proceeding.

CI Pipeline Optimizer — Biomimetic

> "The leafcutter ant colony has no project manager. > Yet it optimally relocates 15% of all tropical vegetation."

The 9 biological models → CI patterns

Read references/patterns.md for detailed explanations, biology, and dual GitLab/GitHub examples.

| # | Organism | CI Pattern | Key principle | |---|----------|------------|---------------| | 1 | Leafcutter ants (Atta) | Stage Specialization + Artifact Cache | Each job = one role. Artifacts = stigmergy | | 2 | Slime mold (Physarum) | Change-Driven Path Selection + Cache Reinforcement | Only rerun what changed. Content-hashed cache | | 3 | Army ants (Eciton) | Fan-out / Fan-in + Ephemeral Runners | Maximum parallelism, disposable runners | | 4 | Honeybees (Apis) | Autoscaling + Priority-based Runner Tagging | Resources proportional to load | | 5 | Mycelium | Multi-Registry Fallback + Distributed Cache | Zero SPOF, waterfall cache | | 6 | Mitosis | Workflow Fission | Pipeline too big → split into independent workflows (S/M/L/XL semantics canonical in ../shared/tiering.md) | | 7 | Immune system (VDJ) | Combinatorial Fuzzing + Property-Based Testing | Explore the input space, not just the known cases | | 8 | Fungal spores | Full Combinatorial Matrix | OS × arch × version × features, fail-fast: false | | 9 | Tardigrade | Chaos Engineering / Fault Injection | Inject failures to prove survival |

Workflow for analyzing an existing pipeline

Step 1 — Map the real DAG

Draw the actual dependencies. Identify sequential jobs that could run in parallel. Compute the critical path.

Step 2 — Leafcutter audit

Does each job do ONE thing? Are artifacts properly defined (stigmergy)? Are there generalist jobs that should be split?

Step 3 — Slime mold audit (Physarum)

Are there jobs running without any relevant change? Are cache keys based on content? Are retries selective? Content-hashed keys and reproducibility are shared in ../shared/determinism.md. CI stages map onto the shared T0-T4 rungs (../shared/gate-ladder.md): the release gate fails at the lowest red rung.

Step 4 — Army ants audit

Which slow jobs can be fanned out in parallel? Are runners ephemeral? Are fan-ins happening too early?

Step 5 — Honeybee audit

Are runners sized for the right profile? Is scale-to-zero enabled? Do critical jobs have dedicated runners?

Step 6 — Mycelium audit

Are there SPOFs (registry, cache, single runner)? Does the cache have a waterfall fallback? Do multi-project pipelines share expensive artifacts?

Step 7 — Immune system audit

Is there fuzzing on parsers, serialization, auth? Do tests use property-based testing? Is the crash corpus persisted across runs?

Step 8 — Spore audit

Does the matrix cover OS × arch × version × features? Are nightly/beta combinations marked allow_failure? Are impossible combinations excluded?

Step 9 — Tardigrade audit

Are there tests under degraded network conditions? Tests under resource pressure? Tests with clock skew? Is graceful degradation verified?

---

Mandatory rules

GitHub Action version verification

Before recommending a version bump for a GitHub Action (e.g. @v3 → @v4), verify that the target tag actually exists:

1. Floating major tags (@v4) are a convention, not a requirement. Some maintainers don't create them.
2. Always verify via gh api repos/{owner}/{repo}/git/refs/tags/{tag} that the exact tag exists.
3. If the floating major tag doesn't exist, pin to the latest patch version (e.g. @v4.1.1).
4. Never assume a major tag exists just because patch tags do.

> Reference incident: bumping cosign-installer@v3 → @v4 broke CI because the v4 tag didn't exist (2026-03-27).

Gotchas

Read ../gotchas.md before producing output to avoid known mistakes.

---

Anti-patterns to identify

| Anti-pattern | Broken biology | GitLab fix | GitHub Actions fix | |---|---|---|---| | Sequential jobs with no real dependency | Generalist ant | Direct needs: DAG | needs: between jobs | | Cache key = branch or date | Slime mold with no memory | key: files: [Cargo.lock] | key: rust-${{ hashFiles('Cargo.lock') }} | | Retry on everything | Slime mold retracing wrong paths | when: [runner_system_failure] | nick-fields/retry with retry_on: error | | Full rebuild on minor change | Slime mold with no pruning | rules: changes: | on.push.paths or dorny/paths-filter | | Single runner for everything | No caste division | tags: + autoscaler | Runner labels + larger runners | | Registry without fallback | Mycelium without redundancy | cmd1 \|\| cmd2 \|\| cmd3 | same | | Huge artifacts passed everywhere | Forager carrying everything to everyone | Scoped artifacts, selective needs: | Named artifacts + selective download-artifact | | Non-sharded tests | Army ants with no flanks | parallel: N + sharding | strategy.matrix + sharding | | Tests only on hand-written cases | Immune system with no VDJ | cargo fuzz + proptest | same | | Single OS/version combination | Single spore, no dispersal | parallel: matrix: | Combinatorial strategy.matrix | | No tests under degraded conditions | Sedentary tardigrade | Toxiproxy + stress-ng + faketime | same |

---

Success metrics

• Critical path: 80% on dependencies
• Runner utilization: > 70%
• Flaky test rate: 15 min | 45/60 (75%) for a production project.

---

Pipeline Pre-Mortem

Before merging a pipeline change, imagine the failures:

1. Poisoned cache (malicious artifact)
2. Compromised runner (secret leak)
3. Registry down (no fallback)
4. Flaky job retry-masked for 3 months
5. Cache miss → 45-minute pipeline
6. Cross-workflow dependency silently broken
7. DAG dependency diamond (C fails silently)

For each scenario: what mitigation ALREADY exists? If none → accepted risk, document it.

---

Pipeline Mutation Testing

The mutation set + scorecard threshold is this skill's post-verification gate; the 3-phase definition-of-done structure (pre → during → post) is canonical in ../shared/done-gate.md.

| Mutation | Expected | If it passes = bug | |----------|----------|-------------------| | Remove a needs: | Job runs too early | DAG misconfigured | | Cache key always-hit | Poisoned cache detected | No validation | | Remove paths: filter | Everything rebuilds (slow) | OK (conservative) | | continue-on-error: true everywhere | Release despite failure | Missing gate | | Remove security scan | Release without scan | No security gate | | Double timeout-minutes | Slow job not detected | No duration alert |

If > 2 mutations pass silently, the pipeline has holes.

---

Reference templates

• references/patterns.md — The 9 biological models in detail with GitLab + GitHub Actions examples
• references/scoring.md — Detailed 15-dimension scoring + scorecard
• references/gitlab-ci-biomimic.yml — Complete GitLab pipeline
• references/github-actions-biomimic.yml — Complete GitHub Actions pipeline
• references/runner-autoscaler.toml — GitLab Runner autoscaler config (honeybees)
• references/cache-strategy.md — Advanced cache strategies (slime mold + mycelium)

Dynamic Handoffs

| Condition detected | Recommend | Why | |-------------------|-----------|-----| | Shell scripts used as pipeline entrypoints | /cli-audit-shell | Audit the scripts | | Tests referenced in CI but not audited | /cli-audit-test | Test strategy audit | | Pipeline builds containers | /cli-forge-infra | Container/image audit | | Pipeline has > 10 jobs with complex dependencies | /cli-audit-tangle | CI dependency topology | | Pipeline lacks a perf budget gate, or A/B benches are not reproducible | /cli-forge-perf | Native bench protocol (Criterion/benchstat/hyperfine) + content-hashed cache → reproducible perf gate | | Jobs rebuild far more than the change (image layers or caches invalidated on every run) | /cli-audit-hanoi | Ordering/layering audit of build steps and image stacks |

Rule: Recommend, don't auto-execute.

Integration with other cli-* skills

| Skill | Relationship | |-------|-------------| | cli-audit-test | D13 covers drift detection within tests. cli-forge-pipeline covers the CI that executes those tests | | cli-audit-code | Audits code quality. cli-forge-pipeline audits pipeline quality | | cli-forge-perf | Pipeline is the natural home of the perf gate: content-hashed cache (../shared/determinism.md) makes baselines reproducible; A/B bench jobs run on every PR; lowest red rung of ../shared/gate-ladder.md includes T4 perf stress | | cli-cycle | Calls cli-forge-pipeline as part of the full review |

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Destynova2
• Source: Destynova2/cli-code-skills
• License: MIT

Install and usage instructions live in the source repository linked above.