ci-pipeline-setup
Set Up GitHub Actions CI/CD
Manual checks slow reviews and let inconsistent releases reach production. This skill creates GitHub Actions workflows with required quality gates and deployment patterns.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "ci-pipeline-setup" from https://skillstore.io/skills/doyajin174-ci-pipeline-setup.md and its manifest at https://skillstore.io/api/skills/doyajin174-ci-pipeline-setup/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "ci-pipeline-setup". Create CI for a Node project with tests and TypeScript.
Expected outcome:
- A staged GitHub Actions plan covering linting, formatting, type checks, tests, builds, and dependency audit.
- Suggested package scripts that match the workflow jobs.
- A merge checklist for required status checks.
Using "ci-pipeline-setup". Add deployment automation for Vercel.
Expected outcome:
- A deployment plan that runs only after CI passes.
- Separate production and preview deployment flows.
- A list of required secret names and permission boundaries.
Using "ci-pipeline-setup". Harden pull request validation for an existing repository.
Expected outcome:
- Recommended branch protection settings for main branches.
- Dependabot and PR labeling automation guidance.
- Security notes for token handling and workflow permissions.
Security Audit
Medium RiskMost static findings are false positives caused by Markdown syntax, not executable Ruby backticks. The GitHub documentation links and GITHUB_TOKEN example are benign workflow references. One contextual risk remains: the Vercel deployment template passes secrets to a mutable third-party action.
Confirmed security concerns (1)
Risk Factors
⚙️ External commands (23)
🌐 Network access (3)
🔑 Env variables (1)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/doyajin174-ci-pipeline-setup/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/doyajin174-ci-pipeline-setup?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/doyajin174-ci-pipeline-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/doyajin174-ci-pipeline-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/doyajin174-ci-pipeline-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Doyajin174. (2026). ci-pipeline-setup security audit report (audit version 8) [Author version 1.0]. Skillstore. https://skillstore.io/skills/doyajin174-ci-pipeline-setup/audits/8BibTeX citation
@techreport{doyajin174-doyajin174-ci-pipeline-setup-2026,
author = {Doyajin174},
title = {ci-pipeline-setup security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/doyajin174-ci-pipeline-setup/audits/8},
note = {Author version 1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ci-pipeline-setup security audit report (audit version 8)"
version: "1.0"
type: report
authors:
- name: "Doyajin174"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/doyajin174-ci-pipeline-setup/audits/8"
identifiers:
- type: other
value: "skillstore:doyajin174-ci-pipeline-setup:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Create a new CI baseline
Add required lint, type check, test, build, and audit jobs to a new repository.
Standardize pull request checks
Map GitHub branch protection settings to the workflow jobs that must pass before merge.
Add deployment automation
Plan production and preview deployments after quality checks pass in GitHub Actions.
Try These Prompts
Create a GitHub Actions CI workflow for this project. Include lint, type check, test, build, and npm audit jobs.
Review the CI workflow and list the branch protection checks that should be required before pull requests can merge.
Improve this GitHub Actions pipeline with matrix testing, dependency caching, and clear job dependencies. Keep the same validation stages.
Design a full CI/CD plan for this repository. Include GitHub Actions checks, Dependabot, branch protection, Vercel deployment, required secrets, and security hardening.
Best Practices
- Pin third-party actions to reviewed versions or commit SHAs when secrets are available.
- Use GitHub Secrets and least-privilege workflow permissions for every deployment token.
- Make branch protection require the same job names used in workflows.
Avoid
- Do not bypass CI by merging directly to protected branches.
- Do not store deployment tokens or API keys in workflow files.
- Do not add deploy jobs before tests and builds block unsafe releases.
Frequently Asked Questions
Does this skill create workflow files?
Which projects fit best?
Can it configure branch protection automatically?
Does it support deployment?
What secrets are needed?
Is it safe for private repositories?
Developer Details
Author
Doyajin174License
MIT
Author version
v1.0
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Ref
c579efd02184f1128d6741d16e6c8d951d7d4208
Maintenance freshness
7/18/2026
Usage
4 downloads · 201 views
File structure
📄 SKILL.md