# Cli Forge Pipeline

> >

- **Type:** Skill
- **Install:** `agentstack add skill-destynova2-cli-code-skills-cli-forge-pipeline`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Destynova2](https://agentstack.voostack.com/s/destynova2)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Destynova2](https://github.com/Destynova2)
- **Source:** https://github.com/Destynova2/cli-code-skills/tree/main/cli-forge-pipeline

## Install

```sh
agentstack add skill-destynova2-cli-code-skills-cli-forge-pipeline
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

> **Optimization:** This skill uses on-demand loading. Heavy content lives in `references/` and is loaded only when needed.

> **Language rule:** Skill instructions are written in English. When generating user-facing output (reports, files, documentation), detect the project's primary language (from README, comments, docs, commit messages) and produce the output in that language. If the project is bilingual, ask the user which language to use before proceeding.

# CI Pipeline Optimizer — Biomimetic

> *"The leafcutter ant colony has no project manager.
> Yet it optimally relocates 15% of all tropical vegetation."*

## The 9 biological models → CI patterns

Read `references/patterns.md` for detailed explanations, biology, and dual GitLab/GitHub examples.

| # | Organism | CI Pattern | Key principle |
|---|----------|------------|---------------|
| 1 | **Leafcutter ants** (Atta) | Stage Specialization + Artifact Cache | Each job = one role. Artifacts = stigmergy |
| 2 | **Slime mold** (Physarum) | Change-Driven Path Selection + Cache Reinforcement | Only rerun what changed. Content-hashed cache |
| 3 | **Army ants** (Eciton) | Fan-out / Fan-in + Ephemeral Runners | Maximum parallelism, disposable runners |
| 4 | **Honeybees** (Apis) | Autoscaling + Priority-based Runner Tagging | Resources proportional to load |
| 5 | **Mycelium** | Multi-Registry Fallback + Distributed Cache | Zero SPOF, waterfall cache |
| 6 | **Mitosis** | Workflow Fission | Pipeline too big → split into independent workflows (S/M/L/XL semantics canonical in `../shared/tiering.md`) |
| 7 | **Immune system** (VDJ) | Combinatorial Fuzzing + Property-Based Testing | Explore the input space, not just the known cases |
| 8 | **Fungal spores** | Full Combinatorial Matrix | OS × arch × version × features, fail-fast: false |
| 9 | **Tardigrade** | Chaos Engineering / Fault Injection | Inject failures to prove survival |

## Workflow for analyzing an existing pipeline

### Step 1 — Map the real DAG
Draw the actual dependencies. Identify sequential jobs that could run in parallel. Compute the critical path.

### Step 2 — Leafcutter audit
Does each job do ONE thing? Are artifacts properly defined (stigmergy)? Are there generalist jobs that should be split?

### Step 3 — Slime mold audit (Physarum)
Are there jobs running without any relevant change? Are cache keys based on content? Are retries selective? Content-hashed keys and reproducibility are shared in `../shared/determinism.md`. CI stages map onto the shared T0-T4 rungs (`../shared/gate-ladder.md`): the **release gate fails at the lowest red rung**.

### Step 4 — Army ants audit
Which slow jobs can be fanned out in parallel? Are runners ephemeral? Are fan-ins happening too early?

### Step 5 — Honeybee audit
Are runners sized for the right profile? Is scale-to-zero enabled? Do critical jobs have dedicated runners?

### Step 6 — Mycelium audit
Are there SPOFs (registry, cache, single runner)? Does the cache have a waterfall fallback? Do multi-project pipelines share expensive artifacts?

### Step 7 — Immune system audit
Is there fuzzing on parsers, serialization, auth? Do tests use property-based testing? Is the crash corpus persisted across runs?

### Step 8 — Spore audit
Does the matrix cover OS × arch × version × features? Are nightly/beta combinations marked `allow_failure`? Are impossible combinations excluded?

### Step 9 — Tardigrade audit
Are there tests under degraded network conditions? Tests under resource pressure? Tests with clock skew? Is graceful degradation verified?

---

## Mandatory rules

### GitHub Action version verification

**Before recommending a version bump for a GitHub Action** (e.g. `@v3` → `@v4`), verify that the target tag actually exists:

1. **Floating major tags** (`@v4`) are a convention, not a requirement. Some maintainers don't create them.
2. **Always verify** via `gh api repos/{owner}/{repo}/git/refs/tags/{tag}` that the exact tag exists.
3. If the floating major tag doesn't exist, **pin to the latest patch version** (e.g. `@v4.1.1`).
4. Never assume a major tag exists just because patch tags do.

> **Reference incident**: bumping `cosign-installer@v3` → `@v4` broke CI because the `v4` tag didn't exist (2026-03-27).

### Gotchas

Read `../gotchas.md` before producing output to avoid known mistakes.

---

## Anti-patterns to identify

| Anti-pattern | Broken biology | GitLab fix | GitHub Actions fix |
|---|---|---|---|
| Sequential jobs with no real dependency | Generalist ant | Direct `needs:` DAG | `needs:` between jobs |
| Cache key = branch or date | Slime mold with no memory | `key: files: [Cargo.lock]` | `key: rust-${{ hashFiles('Cargo.lock') }}` |
| Retry on everything | Slime mold retracing wrong paths | `when: [runner_system_failure]` | `nick-fields/retry` with `retry_on: error` |
| Full rebuild on minor change | Slime mold with no pruning | `rules: changes:` | `on.push.paths` or `dorny/paths-filter` |
| Single runner for everything | No caste division | `tags:` + autoscaler | Runner labels + larger runners |
| Registry without fallback | Mycelium without redundancy | `cmd1 \|\| cmd2 \|\| cmd3` | same |
| Huge artifacts passed everywhere | Forager carrying everything to everyone | Scoped artifacts, selective `needs:` | Named artifacts + selective `download-artifact` |
| Non-sharded tests | Army ants with no flanks | `parallel: N` + sharding | `strategy.matrix` + sharding |
| Tests only on hand-written cases | Immune system with no VDJ | `cargo fuzz` + `proptest` | same |
| Single OS/version combination | Single spore, no dispersal | `parallel: matrix:` | Combinatorial `strategy.matrix` |
| No tests under degraded conditions | Sedentary tardigrade | Toxiproxy + stress-ng + faketime | same |

---

## Success metrics

- **Critical path**:  80% on dependencies
- **Runner utilization**: > 70%
- **Flaky test rate**:  15 min |  45/60 (75%) for a production project.

---

## Pipeline Pre-Mortem

Before merging a pipeline change, imagine the failures:

1. Poisoned cache (malicious artifact)
2. Compromised runner (secret leak)
3. Registry down (no fallback)
4. Flaky job retry-masked for 3 months
5. Cache miss → 45-minute pipeline
6. Cross-workflow dependency silently broken
7. DAG dependency diamond (C fails silently)

For each scenario: what mitigation ALREADY exists? If none → accepted risk, document it.

---

## Pipeline Mutation Testing

The mutation set + scorecard threshold is this skill's post-verification gate; the 3-phase definition-of-done structure (pre → during → post) is canonical in `../shared/done-gate.md`.

| Mutation | Expected | If it passes = bug |
|----------|----------|-------------------|
| Remove a `needs:` | Job runs too early | DAG misconfigured |
| Cache key `always-hit` | Poisoned cache detected | No validation |
| Remove `paths:` filter | Everything rebuilds (slow) | OK (conservative) |
| `continue-on-error: true` everywhere | Release despite failure | Missing gate |
| Remove security scan | Release without scan | No security gate |
| Double `timeout-minutes` | Slow job not detected | No duration alert |

If > 2 mutations pass silently, the pipeline has holes.

---

## Reference templates

- `references/patterns.md` — The 9 biological models in detail with GitLab + GitHub Actions examples
- `references/scoring.md` — Detailed 15-dimension scoring + scorecard
- `references/gitlab-ci-biomimic.yml` — Complete GitLab pipeline
- `references/github-actions-biomimic.yml` — Complete GitHub Actions pipeline
- `references/runner-autoscaler.toml` — GitLab Runner autoscaler config (honeybees)
- `references/cache-strategy.md` — Advanced cache strategies (slime mold + mycelium)

## Dynamic Handoffs

| Condition detected | Recommend | Why |
|-------------------|-----------|-----|
| Shell scripts used as pipeline entrypoints | `/cli-audit-shell` | Audit the scripts |
| Tests referenced in CI but not audited | `/cli-audit-test` | Test strategy audit |
| Pipeline builds containers | `/cli-forge-infra` | Container/image audit |
| Pipeline has > 10 jobs with complex dependencies | `/cli-audit-tangle` | CI dependency topology |
| Pipeline lacks a perf budget gate, or A/B benches are not reproducible | `/cli-forge-perf` | Native bench protocol (Criterion/benchstat/hyperfine) + content-hashed cache → reproducible perf gate |
| Jobs rebuild far more than the change (image layers or caches invalidated on every run) | `/cli-audit-hanoi` | Ordering/layering audit of build steps and image stacks |

**Rule:** Recommend, don't auto-execute.

## Integration with other cli-* skills

| Skill | Relationship |
|-------|-------------|
| `cli-audit-test` | D13 covers drift detection within tests. cli-forge-pipeline covers the **CI that executes** those tests |
| `cli-audit-code` | Audits code quality. cli-forge-pipeline audits **pipeline quality** |
| `cli-forge-perf` | Pipeline is the natural home of the perf gate: content-hashed cache (`../shared/determinism.md`) makes baselines reproducible; A/B bench jobs run on every PR; lowest red rung of `../shared/gate-ladder.md` includes T4 perf stress |
| `cli-cycle` | Calls cli-forge-pipeline as part of the full review |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Destynova2](https://github.com/Destynova2)
- **Source:** [Destynova2/cli-code-skills](https://github.com/Destynova2/cli-code-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-destynova2-cli-code-skills-cli-forge-pipeline
- Seller: https://agentstack.voostack.com/s/destynova2
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.