CI/CD Pipeline Builder with Gated Deploys
Generates CI/CD workflows from your repo's real stack: cached fast-fail checks, pinned actions, and staging-to-prod deploys with gates.
Before & after
Same prompt, same agent — the only difference is the skill.
Setting up CI/CD for a Node project usually involves: - Running tests on every push - Linting and type checks - Building the project - Deploying on merge to main You could use GitHub Actions, GitLab CI, or similar. A basic pipeline would install dependencies, run tests, and deploy. You'd want to add caching to speed things up and secrets management for deploy credentials. Which CI platform are you using, and where do you deploy?
CI/CD generated from your project's actual stack signals — detected, not
assumed. Here's what the scan produces for a Node project.
DETECTED
package.json → npm, test script present, build script present
A lockfile → cache key derived from it
A Dockerfile or a vercel.json → picks the deploy stage automatically
PIPELINE — fast baseline, in stages
1. INSTALL — cached on the lockfile hash, so unchanged deps don't
reinstall. This is the single biggest CI speed win and it's on by
default.
2. CHECK — lint + typecheck + test, run in parallel, not in series.
A pipeline that runs them sequentially wastes minutes on every push.
3. BUILD — only if CHECK passes.
4. DEPLOY — environment-aware: PR → preview, main → production. Never
deploys an un-checked build.
THE ENVIRONMENT-AWARE PART
The deploy stage branches on the trigger: a pull request gets a preview
deploy, a merge to main gets production. Secrets pulled from the CI
secret store, never in the file. This is what stops a PR from
accidentally shipping to prod.
WHY DETECTION-DRIVEN
Hand-written pipelines drift from the project — the test command changes
and CI still runs the old one. Generating from the real package.json
keeps them in sync, and makes the same pipeline repeatable across repos.
Point me at the repo and I'll generate the actual pipeline file for your
CI platform.About this skill
Your CI takes 20 minutes, the cache never hits, and nobody is sure the image in prod is the one that passed staging. Generic pipeline templates make it worse: they invent scripts your repo doesn't have, hardcode the wrong runtime version, and run every job with broad permissions. This skill builds pipelines from the files actually in your repo and promotes one tested artifact through staging to a gated production deploy.
What it does
- Reads lockfiles, version files, and package scripts to choose install commands, runtime versions, and checks, and flags missing lint or test scripts instead of inventing them
- Orders cheap checks first and runs independent jobs in parallel, with frozen installs and lockfile-keyed caches that actually hit
- Locks down security: read-only default permissions, per-job grants, SHA-pinned third-party actions, OIDC instead of long-lived cloud keys, and no script injection from event data
- Builds once, tags by commit SHA, deploys the same artifact to staging, smoke-tests it, then gates production behind approval
- Handles the traps that block merges or break deploys: path-filtered required checks stuck pending, cancelled half-deploys, racing database service containers, unsafe migrations
- Reviews pasted workflow YAML and returns findings ranked Blocker, Should fix, and Nice, each with a corrected snippet
What you get
Ready-to-commit workflow files (GitHub Actions by default, GitLab CI on request), with a grounding list showing which repo file drove each decision. You also get the settings that live outside YAML (branch protection, environments, secrets) and a one-line rollback plan.
Best for
Developers and small platform teams setting up CI for a new repo, cleaning up a slow or flaky pipeline, or adding staged deploys with a real production gate.
SKILL.md preview
---
name: ci-cd-pipeline-builder-gated-deploys
description: Builds or fixes CI/CD pipelines (GitHub Actions by default, GitLab CI on request) from the repo's actual stack signals (lockfiles, version files, package scripts). It orders cheap checks first, caches correctly, locks down permissions, and promotes one built artifact through staging to a gated production deploy. Use when the user says "set up CI for this repo", "write a GitHub Actions workflow", "add deploys to staging and prod", "our CI takes 20 minutes", "my cache never hits", "review this workflow yaml", "CI keeps failing randomly", "the required check is stuck pending".
---
# CI/CD Pipeline Builder with Gated Deploys
… (sign up to view the full skill)More development skills
View all Development skills →Chaos Experiment and Game Day Planner
Plans chaos experiments and game days: hypothesis, blast radius, abort conditions, tool manifests, rollback, and post-run review.
Claude Code Cost and Latency Routing
Configure Claude Code Router with model tiers, explicit fallbacks, compatibility checks, and a cost-aware validation plan.
Terraform Modules and Safe Deployments
Get reusable Terraform modules, safe state migrations, explicit provider wiring, and CI gates tied to reviewed plans.
Dockerfile and Compose Review: Size, Cache, Security
Rewrites Dockerfiles and compose files for smaller images, cache-friendly builds, and non-root, secret-free containers, with reasons.