CI/CD Pipeline Automation
Build repeatable quality gates and reversible deployment pipelines for every change.
The skill makes major risks visible through Secrets guidance, separation of production credentials, staged rollout, and rollback recommendations. It does not fully specify least privilege, user confirmation, pinned third-party actions, deployment data flows, or rollback preconditions; the example also passes VERCEL_TOKEN directly to npx vercel, so full marks are not justified.
The workflow is generally coherent and includes quality gates, failure feedback, health checks, and rollback examples. However, it assumes project-specific npm scripts and undeclared tools, and its examples do not consistently implement the gates shown in the overview: integration, E2E, and bundle-size checks are omitted from the basic pipeline. Failure diagnostics for unsupported environments and abnormal input are limited; static calibration caps this below 10.
The intended scenarios and triggers are fairly clear, covering CI setup, deployment, failure debugging, and optimization. Boundaries for other languages, CI providers, deployment systems, project sizes, and non-fit cases are weak. The material is strongly Node.js/GitHub Actions-oriented and gives no Chinese-language or mainland-China reachability guidance, limiting environment fit.
The document has clear sections, diagrams, configuration examples, anti-rationalization guidance, red flags, and a verification checklist. Repository context supplies MIT licensing, installation instructions, and named maintainers. Still, the skill lacks its own versioning, changelog, dependency matrix, troubleshooting path, and explicit update responsibility, while several environment and parameter assumptions remain unstated.
The skill provides useful templates for CI, integration tests, E2E, preview deployments, staged rollouts, and rollback, so it can guide real implementation. Nevertheless, substantial project-specific adaptation remains, equivalent patterns for non-GitHub platforms and pre-deployment confirmation are missing, and no representative outputs are verified. Some mandatory gates may also impose disproportionate cost, so only moderate value is supported statically.
The pinned revision includes a real GitHub Actions workflow validating skill structure, eval execution, and plugin installation. Those tests do not cover the target skill's substantive CI/CD paths, and the included slug test is unrelated. There are no third-party execution results or multiple corroborating evidence types, so verifiability remains limited.
- The deployment examples are Vercel-, GitHub Actions-, and Node.js-specific; verify platform support, tool versions, permission scope, and credential exposure before adoption.
- The claim that no gate may be skipped conflicts with E2E being marked optional; projects should explicitly classify mandatory checks by risk.
- This assessment is based only on static files; the pipelines, installation flow, and rollback procedure were not executed.
What does this skill do, and when should you use it?
This skill helps configure or modify build, test, and deployment pipelines. It promotes a sequence of merge-blocking gates such as linting, type checking, unit tests, builds, and security audits, with CI failures fed back into the coding-agent workflow. It also covers GitHub Actions, database integration tests, E2E testing, preview deployments, feature flags, staged rollouts, and rollback procedures. It is a good fit for teams standardizing engineering verification and release operations.
It guides agents through creating or updating GitHub Actions workflows with Node.js 22, npm ci, linting, TypeScript checks, unit tests, builds, and npm audit. Optional examples configure PostgreSQL services, database migrations, Playwright E2E tests, and failure artifacts. It also covers preview deployments, feature flags, staging-to-production rollouts, GitHub Secrets, Dependabot or Renovate, branch protection, and manually triggered rollback workflows.
- A developer is creating the first pull-request and main-branch CI pipeline for a new project.
- A team needs linting, type checks, tests, builds, and security audits to block merges.
- A backend team needs PostgreSQL, Prisma migrations, and integration tests in CI.
- A frontend team wants preview deployments for pull requests and Playwright or Cypress E2E checks.
- A release owner needs staging verification, feature-flagged rollout, and rollback procedures.
- A team needs to diagnose CI failures and give precise failure output to a coding agent for repair and re-verification.
What are this skill's strengths and limitations?
- Covers the path from quality checks through deployment, monitoring windows, and rollback.
- Includes concrete GitHub Actions YAML examples.
- Explicitly recommends Secrets for CI credentials and keeping production secrets out of CI.
- Provides optimization tactics including caching, parallel jobs, path filters, and test sharding.
- Defines a practical feedback loop for sending CI failures back to coding agents.
- Examples focus mainly on GitHub Actions, Node.js, and npm; other CI providers are not configured in detail.
- Deployment examples use Vercel, so equivalent depth for other deployment platforms is not established.
- The source provides workflows and examples but no evidence of a test suite for the skill itself or measured runtime results.
- Several examples assume the project already has lint, test, build, migration, or deployment commands.
How do you install this skill?
Install the full repository with: npx skills add addyosmani/agent-skills. Install only this skill with: npx skills add addyosmani/agent-skills --skill ci-cd-and-automation. The README does not specify a universal client-specific directory for an individual skill; it states that the skills CLI installs the collection into multiple coding agents.
How do you use this skill?
After installation, give the agent a concrete request such as: “Set up GitHub Actions CI for this Node.js project with lint, tsc, unit tests, build, and npm audit, and make failed checks block merges.” You can also request PostgreSQL integration tests, pull-request previews, staged deployment, or rollback workflows. The skill description explicitly targets setting up or modifying build and deployment pipelines and debugging CI failures.
How does this skill compare with similar options?
The README names Superpowers and Matt Pocock’s skills as alternatives and links to comparison documentation; the supplied source does not include specific comparative conclusions.