CI/CD Pipeline

Router skill for CI/CD pipeline generation. Dispatches to handler files based on sub-command.

When to Use

• Creating new CI/CD pipelines for a project.
• Evolving existing pipelines with advanced patterns.
• Validating pipeline compliance (SHA pinning, timeouts, concurrency).
• NOT for running pipelines -- that is the CI system's job.

Process

Step 0: Load Stack Contexts

Follow .ai-engineering/contexts/stack-context.md. Apply loaded standards to all subsequent work.

Routing

Default (no sub-command): generate.

Quick Reference

/ai-pipeline generate                    # new pipeline from project analysis
/ai-pipeline generate --provider azure   # Azure Pipelines specifically
/ai-pipeline evolve                      # add advanced patterns
/ai-pipeline validate                    # check compliance

Shared Rules

• SHA pinning: all third-party actions use SHA pins. First-party (actions/*) may use major tags.
• No * versions: explicit version constraints always.
• OIDC auth: prefer OIDC over long-lived secrets.
• Timeouts: every job must have timeout-minutes.
• Concurrency: group by branch to prevent parallel runs.

Integration

• Stack detection: reads providers.stacks from .ai-engineering/manifest.yml.
• Validation: actionlint for GitHub Actions.
• Policy: scripts/check_workflow_policy.py for SHA pinning and timeout compliance.
• Boundary: /ai-governance validates governance process; /ai-pipeline generates and validates the workflow files themselves

References

• .ai-engineering/manifest.yml -- CI/CD standards.
• .ai-engineering/contexts/ -- per-stack check definitions. $ARGUMENTS