claude-mods/skills/ci-cd-ops/SKILL.md

---

name: ci-cd-ops description: "CI/CD pipeline patterns with GitHub Actions, release automation, and testing strategies. Use for: github actions, workflow, CI, CD, pipeline, deploy, release, semantic release, changesets, goreleaser, matrix, cache, secrets, environment, artifact, reusable workflow, composite action." license: MIT allowed-tools: "Read Write Bash" metadata: author: claude-mods

related-skills: git-ops, docker-ops, testing-ops

CI/CD Operations

Comprehensive patterns for continuous integration, delivery, and deployment using GitHub Actions, release automation tools, and testing pipelines.

GitHub Actions Quick Reference

Workflow File Anatomy

name: CI                          # Display name in Actions tab
on:                               # Trigger events
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:                      # GITHUB_TOKEN scope (least privilege)
  contents: read
  pull-requests: write

concurrency:                      # Prevent duplicate runs
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:                              # Workflow-level environment variables
  NODE_VERSION: "20"

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: npm
      - run: npm ci
      - run: npm test

Core Syntax Elements

Element	Purpose	Example
on	Event triggers	push, pull_request, schedule
jobs.<id>.runs-on	Runner selection	ubuntu-latest, self-hosted
jobs.<id>.needs	Job dependencies	needs: [build, lint]
jobs.<id>.if	Conditional execution	if: github.event_name == 'push'
jobs.<id>.strategy.matrix	Parallel variants	node-version: [18, 20, 22]
jobs.<id>.environment	Deployment target	environment: production
jobs.<id>.permissions	Token scope	contents: write
steps[*].uses	Use an action	uses: actions/checkout@v4
steps[*].run	Run a command	run: npm test
steps[*].env	Step environment	env: { CI: true }

Trigger Decision Tree

Scenario	Trigger	Config
Run tests on every PR	pull_request	branches: [main]
Deploy on merge to main	push	branches: [main]
Release on version tag	push	tags: ['v*']
Nightly builds	schedule	cron: '0 2 * * *'
Manual deployment	workflow_dispatch	inputs: { environment: ... }
Called by another workflow	workflow_call	inputs:, secrets:
On PR label change	pull_request	types: [labeled]
On issue comment	issue_comment	types: [created]
On release published	release	types: [published]
On package push	registry_package	types: [published]

Trigger Filter Patterns

on:
  push:
    branches: [main, 'release/**']      # Branch patterns
    paths: ['src/**', '!src/**/*.test.*'] # Path filters (ignore tests)
    tags: ['v*']                          # Tag patterns
  pull_request:
    types: [opened, synchronize, reopened] # Default types
    paths-ignore: ['docs/**', '*.md']     # Ignore docs-only changes

Caching Strategies

Ecosystem	Action / Key	Path	Restore Key
Node (npm)	actions/setup-node with cache: npm	Auto	Auto
Node (pnpm)	actions/setup-node with cache: pnpm	Auto	Auto
Go modules	actions/setup-go with cache: true	Auto	Auto
Cargo	actions/cache@v4	~/.cargo/registry, target	cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
pip / uv	actions/setup-python with cache: pip	Auto	Auto
Docker layers	docker/build-push-action	Uses buildx cache	type=gha or type=registry
Gradle	actions/setup-java with cache: gradle	Auto	Auto
Composer	actions/cache@v4	vendor	composer-${{ hashFiles('composer.lock') }}

Manual Cache Example

- uses: actions/cache@v4
  with:
    path: |
      ~/.cargo/bin
      ~/.cargo/registry
      ~/.cargo/git
      target
    key: cargo-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
    restore-keys: |
      cargo-${{ runner.os }}-

Matrix Strategy

strategy:
  fail-fast: false                    # Don't cancel siblings on failure
  max-parallel: 4                     # Limit concurrent jobs
  matrix:
    os: [ubuntu-latest, windows-latest, macos-latest]
    node-version: [18, 20, 22]
    include:                          # Add specific combos
      - os: ubuntu-latest
        node-version: 22
        coverage: true
    exclude:                          # Remove specific combos
      - os: windows-latest
        node-version: 18

Dynamic Matrix

prepare:
  runs-on: ubuntu-latest
  outputs:
    matrix: ${{ steps.set.outputs.matrix }}
  steps:
    - id: set
      run: echo "matrix=$(jq -c . matrix.json)" >> "$GITHUB_OUTPUT"

test:
  needs: prepare
  strategy:
    matrix: ${{ fromJson(needs.prepare.outputs.matrix) }}

Secrets Management

Scope	Access	Use Case
Repository secrets	All workflows in repo	API keys, tokens
Environment secrets	Jobs targeting that environment	Production credentials
Organization secrets	Selected repos in org	Shared service accounts
OIDC tokens	Federated identity	Cloud deployment (no stored secrets)

Secrets Best Practices

# Reference secrets - NEVER echo or log them
- run: deploy --token ${{ secrets.DEPLOY_TOKEN }}

# Mask custom values
- run: echo "::add-mask::$CUSTOM_SECRET"

# Use environments for deployment secrets
jobs:
  deploy:
    environment: production           # Requires approval + has secrets
    steps:
      - run: deploy --key ${{ secrets.PROD_API_KEY }}

OIDC for Cloud (No Stored Secrets)

permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789:role/github-actions
      aws-region: us-east-1

Common Workflow Patterns

Test on Pull Request

name: Test
on:
  pull_request:
    branches: [main]
concurrency:
  group: test-${{ github.head_ref }}
  cancel-in-progress: true
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20, cache: npm }
      - run: npm ci
      - run: npm run lint
      - run: npm test -- --coverage

Deploy on Merge to Main

name: Deploy
on:
  push:
    branches: [main]
jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build
      - run: npx wrangler deploy
        env:
          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}

Release on Tag

name: Release
on:
  push:
    tags: ['v*']
permissions:
  contents: write
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: |
          gh release create ${{ github.ref_name }} \
            --generate-notes \
            --title "${{ github.ref_name }}"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Gotchas Table

Gotcha	Problem	Fix
Shallow clone	git describe fails, history missing	actions/checkout@v4 with fetch-depth: 0
Default permissions	GITHUB_TOKEN is read-only by default	Set permissions: explicitly
Action pinning	@main can break without warning	Pin to SHA: @abc123 or @v4
Fork PR secrets	Secrets unavailable on fork PRs	Use pull_request_target carefully
Concurrent deploys	Race condition on production	Use concurrency: groups
Stale caches	Cache grows unbounded	Include lockfile hash in key
Node.js version	setup-node defaults vary	Always specify node-version
Docker layer cache	Rebuilds everything without cache	Use cache-from: type=gha
Matrix + environment	Each matrix job needs approval	Use a single deploy job after matrix
Path filters + required checks	Skipped jobs block merge	Use paths-filter action or make checks non-required
GITHUB_TOKEN in PRs	Cannot trigger other workflows	Use a PAT or GitHub App token
Windows line endings	Scripts fail with \r\n	Use .gitattributes or core.autocrlf

Expression Syntax Quick Reference

Expression	Result
${{ github.event_name }}	push, pull_request, etc.
${{ github.ref_name }}	Branch or tag name
${{ github.sha }}	Full commit SHA
${{ github.actor }}	User who triggered
${{ runner.os }}	Linux, Windows, macOS
${{ contains(github.event.head_commit.message, '[skip ci]') }}	Check commit message
${{ needs.build.outputs.version }}	Output from prior job
${{ fromJson(steps.meta.outputs.json) }}	Parse JSON output
${{ hashFiles('**/package-lock.json') }}	Hash for cache keys
${{ format('refs/heads/{0}', matrix.branch) }}	String formatting
${{ toJson(matrix) }}	Debug: print matrix config

Step Outputs

steps:
  - id: version
    run: echo "value=$(cat VERSION)" >> "$GITHUB_OUTPUT"

  - run: echo "Version is ${{ steps.version.outputs.value }}"

Job Outputs (for Cross-Job Communication)

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      artifact-id: ${{ steps.upload.outputs.artifact-id }}
    steps:
      - id: upload
        run: echo "artifact-id=abc123" >> "$GITHUB_OUTPUT"

  deploy:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deploying ${{ needs.build.outputs.artifact-id }}"

Reference Files

File	Contents
references/github-actions.md	Complete workflow syntax, reusable workflows, composite actions, OIDC, runners, debugging
references/release-automation.md	Semantic versioning, semantic-release, changesets, goreleaser, changelog, publishing
references/testing-pipelines.md	Test stages, parallelism, coverage, service containers, e2e in CI, deployment pipelines