Skills gitlab-ci-patterns

📦

gitlab-ci-patterns

Name: gitlab-ci-patterns
Author: wshobson

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access

Build GitLab CI/CD Pipelines

GitLab pipeline design can become inconsistent across build, test, release, and infrastructure jobs. This skill provides practical CI/CD patterns for staged automation, caching, Docker publishing, deployments, Terraform, and security scanning.

Supports: Claude Codex Code(CC)

📊 69 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "gitlab-ci-patterns" from https://skillstore.io/skills/wshobson-gitlab-ci-patterns.md and its manifest at https://skillstore.io/api/skills/wshobson-gitlab-ci-patterns/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/wshobson-gitlab-ci-patterns.md Signed manifest GET /api/skills/wshobson-gitlab-ci-patterns/manifest Signed lockfile GET /api/skills/wshobson-gitlab-ci-patterns/lockfile

Test it

Using "gitlab-ci-patterns". Node.js service with linting, tests, coverage, and production release.

Expected outcome:

A staged pipeline plan covering dependency installation, build artifacts, coverage reporting, cache keys, and a manual production deployment.

Using "gitlab-ci-patterns". Containerized app that deploys to staging and production Kubernetes namespaces.

Expected outcome:

A deployment workflow with registry publishing, environment-specific jobs, protected variables, rollout checks, and production approval.

Using "gitlab-ci-patterns". Platform repository that manages Terraform and security checks.

Expected outcome:

A CI structure with validation, planning, manual apply, scanning stages, cache guidance, and child pipeline placement.

Security Audit

Medium Risk

v8 • 7/7/2026 Open versioned report

Static command and URL findings are false positives from markdown examples, inline code formatting, and reserved example.com placeholders. I found no prompt-injection or exfiltration intent, but two CI guidance issues need attention: disabled Kubernetes TLS verification and non-blocking high severity image scanning.

Files scanned

272

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:102

Kubernetes TLS Verification Disabled

The deployment template uses --insecure-skip-tls-verify=true when configuring kubectl. This disables API server certificate validation and can permit traffic interception.

The insecure flag appears directly in the deployment template. Legitimate self-signed testing is possible, but marketplace guidance should prefer trusted CA configuration.

Low

SKILL.md:189-194

Security Scan Failures Are Allowed

The Trivy job scans for high and critical image findings but allows the job to fail. This can let vulnerable images pass CI without enforcement.

The scanner command targets HIGH and CRITICAL severities and the job sets allow_failure. Some teams may use advisory scans, so confidence is high but not absolute.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/wshobson-gitlab-ci-patterns/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/wshobson-gitlab-ci-patterns/security.svg)](https://skillstore.io/skills/wshobson-gitlab-ci-patterns?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/wshobson-gitlab-ci-patterns?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/wshobson-gitlab-ci-patterns/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/wshobson-gitlab-ci-patterns.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

wshobson. (2026). gitlab-ci-patterns security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/wshobson-gitlab-ci-patterns/audits/8

BibTeX citation

@techreport{wshobson-wshobson-gitlab-ci-patterns-2026,
  author = {wshobson},
  title = {gitlab-ci-patterns security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/wshobson-gitlab-ci-patterns/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gitlab-ci-patterns security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "wshobson"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/wshobson-gitlab-ci-patterns/audits/8"
identifiers:
  - type: other
    value: "skillstore:wshobson-gitlab-ci-patterns:audit:8"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

wshobson Recommended Current

wshobson-gitlab-ci-patterns

Skillstore Score 69

Evidence Confidence High

Skillstore usage 19

Updated

2026-08-21

sickn33

sickn33-gitlab-ci-patterns

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 10

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Launch application CI

Create build, test, cache, coverage, and artifact jobs for a GitLab-hosted application.

Standardize deployments

Design staging and production deployment stages with GitLab environments and manual production approval.

Extend platform automation

Add Terraform, container scanning, dependency scanning, and child pipelines to an existing delivery workflow.

Try These Prompts

Create a starter pipeline

Create a GitLab CI pipeline for a Node.js app with build, test, cache, coverage, and artifacts.

Add Docker publishing

Extend my GitLab CI pipeline to build a Docker image, tag it by commit, and push it to the GitLab registry.

Design environment deployment

Design staging and production GitLab deployment jobs for Kubernetes with protected variables, manual production approval, and rollback checks.

Plan a platform pipeline

Create a full GitLab CI pattern with Terraform validation, manual infrastructure apply, security scanning, caching, and dynamic child pipelines.

Best Practices

Replace placeholder URLs, namespaces, image names, and variables before committing generated pipelines.
Store secrets in GitLab CI/CD variables and use protected variables for production credentials.
Run generated YAML through GitLab CI Lint and test it on a non-production branch first.

Avoid

Copying example deployment targets directly into production repositories.
Using latest image tags for production jobs without pinning versions.
Running Terraform apply automatically without a manual approval gate.

Frequently Asked Questions

Can this skill create a complete .gitlab-ci.yml file?

Yes. It can draft a complete pipeline, but you should adapt names, variables, secrets, and environments.

Does it support Docker-in-Docker?

Yes. It includes Docker build and registry push patterns using GitLab registry variables.

Can it help with Kubernetes deployments?

Yes. It shows deployment jobs, environment metadata, rollout checks, and manual production gates.

Does it manage secrets?

No. It expects secrets to be stored in GitLab CI/CD variables or another approved secret store.

Can it validate my pipeline?

It can review likely structure and risks, but GitLab CI Lint should validate syntax.

Is it safe for production deployment design?

Use it as a starting point. Remove insecure flags, pin images, and test changes on protected branches.

Developer Details

Author

wshobson

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/wshobson/agents/tree/main/plugins/cicd-automation/skills/gitlab-ci-patterns

Ref

36e07d5e13068e5be64447e8f20b427cf2cbd21a

Maintenance freshness

7/18/2026

Usage

16 downloads · 299 views

File structure

📄 SKILL.md