[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GXD3TS4MYB6K1ND7FACBB7":3,"skill-same:01M6GXD3TS4MYB6K1ND7FACBB7":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":62,"ownerHtmlUrl":63,"ownerBlogUrl":64,"ownerDescription":65,"updatedAt":66,"install":67,"resources":80},"01M6GXD3TS4MYB6K1ND7FACBB7","CI\u002FCD Pipeline Review",null,"Deep review of CI\u002FCD pipelines — GitHub Actions, secrets management, caching strategy, build optimization, deployment safety, and security hardening.","malayvuong\u002Fagent-orchestra","malayvuong","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F13240975?v=4","01M6GXCDVPB2VPZMDZK1KF98M0","Nguyen Minh Vuong","01M6GXCE176VDX3XV4Z4KNR33J",1,"MIT","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fcicd-review\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"pipeline","CI CD Pipeline Review","pipeline review","cd","ci cd pipeline","review","ci","ci cd","actions","github actions","Optimization","deployment","secrets management","strategy","deployment safety","caching","deep","logic","workflow","github","2026-11-10 10:12:30",false,"---\nname: CI\u002FCD Pipeline Review\ndescription: Deep review of CI\u002FCD pipelines — GitHub Actions, secrets management, caching strategy, build optimization, deployment safety, and security hardening.\nversion: 2026.3.1\nlicense: MIT\ntriggers:\n  lenses:\n    - security\n    - logic\n  keywords:\n    - ci\n    - cd\n    - github actions\n    - pipeline\n    - workflow\n    - deploy\n---\n\nWhen reviewing CI\u002FCD configuration, apply the following checks.\n\n## Secrets Management\n\nFlag secrets hardcoded in workflow files — use repository or environment secrets. Flag `echo ${{ secrets.TOKEN }}` — this prints the secret to logs even though GitHub masks known values; log masking is not guaranteed for derived values.\n\nVerify secrets are scoped to the minimum required environment (production secrets only available in the production environment). Flag workflows that pass secrets to third-party actions via environment variables without reviewing the action source.\n\nCheck that `GITHUB_TOKEN` permissions are restricted with `permissions:` block — the default token has write access to the repository. Flag `permissions: write-all`.\n\n## Action Security\n\nFlag third-party actions pinned to a branch (`uses: owner\u002Faction@main`) instead of a commit SHA (`uses: owner\u002Faction@abc123`). Branch references can be silently updated to malicious code. Verify high-privilege actions (deploy, publish, release) use SHA-pinned versions.\n\nFlag `pull_request_target` trigger with `actions\u002Fcheckout` of the PR branch — this executes untrusted PR code with write permissions. Flag `workflow_dispatch` without input validation.\n\n## Caching\n\nVerify dependency caching is enabled for package managers (npm, pnpm, pip, cargo). Flag workflows that install dependencies from scratch on every run. Check that cache keys include the lockfile hash to invalidate on dependency changes.\n\nFlag Docker layer caching that uses `type=gha` without `scope` — this can leak layers between unrelated workflows. Verify build caches are scoped to the branch.\n\n## Build Optimization\n\nFlag sequential steps that could run in parallel using a matrix strategy. Flag duplicate `npm install` or `pip install` across multiple jobs — use a shared setup job with artifact upload. Check that `--frozen-lockfile` (pnpm) or `--ci` (npm) is used — installing without lockfile verification can produce non-reproducible builds.\n\nFlag test suites that run the entire suite on every PR — use test splitting or affected-file detection for large repositories.\n\n## Deployment Safety\n\nVerify production deployments have a manual approval step (environment protection rules). Flag direct pushes to production without a staging\u002Fpreview deployment. Check that rollback procedures exist — deployment workflows should support reverting to the previous version.\n\nFlag deployments that do not verify health after deploying (no smoke test or health check step). Verify database migrations run before the new application version starts, not after.\n\n## Workflow Structure\n\nFlag `continue-on-error: true` on critical steps (tests, security scans, linting) — failures should block the pipeline. Flag missing `timeout-minutes` on jobs — default timeout is 6 hours, which wastes resources on hung jobs.\n\nVerify status checks are required for the default branch — flag repositories where PRs can be merged without passing CI. Check that branch protection rules enforce up-to-date branches before merging.\n\nFor each finding, report: the workflow file and step, the specific CI\u002FCD pattern violated, and the recommended fix.\n","When reviewing CI\u002FCD configuration, apply the following checks.\n\n## Secrets Management\n\nFlag secrets hardcoded in workflow files — use repository or environment secrets. Flag `echo ${{ secrets.TOKEN }}` — this prints the secret to logs even though GitHub masks known values; log masking is not guaranteed for derived values.\n\nVerify secrets are scoped to the minimum required environment (production secrets only available in the production environment). Flag workflows that pass secrets to third-party actions via environment variables without reviewing the action source.\n\nCheck that `GITHUB_TOKEN` permissions are restricted with `permissions:` block — the default token has write access to the repository. Flag `permissions: write-all`.\n\n## Action Security\n\nFlag third-party actions pinned to a branch (`uses: owner\u002Faction@main`) instead of a commit SHA (`uses: owner\u002Faction@abc123`). Branch references can be silently updated to malicious code. Verify high-privilege actions (deploy, publish, release) use SHA-pinned versions.\n\nFlag `pull_request_target` trigger with `actions\u002Fcheckout` of the PR branch — this executes untrusted PR code with write permissions. Flag `workflow_dispatch` without input validation.\n\n## Caching\n\nVerify dependency caching is enabled for package managers (npm, pnpm, pip, cargo). Flag workflows that install dependencies from scratch on every run. Check that cache keys include the lockfile hash to invalidate on dependency changes.\n\nFlag Docker layer caching that uses `type=gha` without `scope` — this can leak layers between unrelated workflows. Verify build caches are scoped to the branch.\n\n## Build Optimization\n\nFlag sequential steps that could run in parallel using a matrix strategy. Flag duplicate `npm install` or `pip install` across multiple jobs — use a shared setup job with artifact upload. Check that `--frozen-lockfile` (pnpm) or `--ci` (npm) is used — installing without lockfile verification can produce non-reproducible builds.\n\nFlag test suites that run the entire suite on every PR — use test splitting or affected-file detection for large repositories.\n\n## Deployment Safety\n\nVerify production deployments have a manual approval step (environment protection rules). Flag direct pushes to production without a staging\u002Fpreview deployment. Check that rollback procedures exist — deployment workflows should support reverting to the previous version.\n\nFlag deployments that do not verify health after deploying (no smoke test or health check step). Verify database migrations run before the new application version starts, not after.\n\n## Workflow Structure\n\nFlag `continue-on-error: true` on critical steps (tests, security scans, linting) — failures should block the pipeline. Flag missing `timeout-minutes` on jobs — default timeout is 6 hours, which wastes resources on hung jobs.\n\nVerify status checks are required for the default branch — flag repositories where PRs can be merged without passing CI. Check that branch protection rules enforce up-to-date branches before merging.\n\nFor each finding, report: the workflow file and step, the specific CI\u002FCD pattern violated, and the recommended fix.\n",{"name":5,"license":15,"version":52,"triggers":53,"description":7},"2026.3.1",{"lenses":54,"keywords":56},[55,44],"security",[33,30,36,27,45,57],"deploy","main","eac6069a8690d89fd23f08d2d14e4874ed376a77",".agent-orchestra\u002Fskills\u002Fcicd-review",0,"https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra","https:\u002F\u002Fgithub.com\u002Fmalayvuong","www.malayvuong.com","Just a newbie at everything","2026-10-09 12:52:45",{"source":8,"skillName":5,"commands":68,"prompt":78,"zipAvailable":79},[69,72,75],{"tool":70,"command":71},"npx","npx skills add malayvuong\u002Fagent-orchestra --skill \"CI\u002FCD Pipeline Review\"",{"tool":73,"command":74},"bunx","bunx skills add malayvuong\u002Fagent-orchestra --skill \"CI\u002FCD Pipeline Review\"",{"tool":76,"command":77},"pnpm","pnpm dlx skills add malayvuong\u002Fagent-orchestra --skill \"CI\u002FCD Pipeline Review\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fcicd-review\u002FSKILL.md",true,[],[82,120,139,157,181,198],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":102,"publishedAt":47},"01M6GXHYPRJ43SHFPFJTF87GS8","Vue.js Review","Deep review of Vue.js applications — Composition API patterns, reactivity traps, component design, Pinia state management, and performance pitfalls.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fvue-review\u002FSKILL.md",[88,91,94,97],{"categoryNo":89,"categoryName":90,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":92,"categoryName":93,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":95,"categoryName":96,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":98,"categoryName":99,"taxonomyType":100,"taxonomyTypeDesc":101},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,43,44,118,119],"vue","js","Vue js Review","design","performance","component","state management","state","deep review","api patterns","applications","api","Composition","pinia","management","pitfalls","pinia state",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":47},"01M6GXHSPDDH1PQEN61ENMCEF5","Unity Review","Deep review of Unity C# code — object pooling, Update allocation, physics patterns, UI performance, serialization, and mobile optimization.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Funity-review\u002FSKILL.md",[],[32,127,122,107,128,129,111,130,131,37,132,133,134,43,44,135,136,137,138],"unity","update","code","ui","serialization","mobile","patterns","physics","C#","mobile optimization","object","allocation",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":47},"01M6GXHNKTH12CGSRWDGF2H1Q9","TypeScript Review","Deep review of TypeScript code — type safety, generics patterns, strict mode compliance, type narrowing, module boundaries, and common escape hatches.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Ftypescript-review\u002FSKILL.md",[],[32,146,147,129,111,148,149,150,151,133,43,44,152,153,154,155,156],"typescript","typescript review","compliance","Type Safety","Safety","common","module","type","interface","consistency","mode",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":169,"publishedAt":47},"01M6GXHH3DMZD272RVH4800C67","Test Conventions","Testing patterns and conventions for code review. Covers naming, AAA structure, boundary testing, mock vs real dependencies, and coverage expectations.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Ftest-conventions\u002FSKILL.md",[163,166],{"categoryNo":164,"categoryName":165,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":167,"categoryName":168,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[170,171,159,172,173,32,129,174,175,176,133,177,178,179,180],"test","conventions","code review","testing","testing patterns","boundary","coverage","dependencies","structure","mock","naming",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":189,"publishedAt":47},"01M6GXHCAQSJDVNVRFFD1HJWTN","Terraform Review","Deep review of Terraform\u002FOpenTofu configuration — state management, module design, security hardening, drift prevention, and production safety patterns.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fterraform-review\u002FSKILL.md",[187,188],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":95,"categoryName":96,"taxonomyType":21,"taxonomyTypeDesc":22},[32,190,183,106,55,109,110,111,191,192,193,194,150,195,117,196,197,43,44,152],"terraform","cloud","aws","hardening","Production","opentofu","iac","drift",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":205,"publishedAt":47},"01M6GXH83F11CK4BQEAJPN6HDE","Swift Review","Deep review of Swift code — memory management, concurrency patterns, optionals, protocol design, SwiftUI lifecycle, and iOS platform patterns.","https:\u002F\u002Fgithub.com\u002Fmalayvuong\u002Fagent-orchestra\u002Fblob\u002Fmain\u002F.agent-orchestra\u002Fskills\u002Fswift-review\u002FSKILL.md",[204],{"categoryNo":95,"categoryName":96,"taxonomyType":21,"taxonomyTypeDesc":22},[206,32,200,106,207,107,129,208,111,209,210,211,212,213,117,43,44,214,215,216],"swift","memory","protocol","ios","concurrency","lifecycle","swiftui","uikit","xcode","apple","platform"]