ci-cd by ahmedasmar/devops-claude-skills
npx skills add https://github.com/ahmedasmar/devops-claude-skills --skill ci-cd涵盖 GitHub Actions、GitLab CI 及其他平台的 CI/CD 流水线设计、优化、安全性和故障排除的全面指南。
在以下情况使用此技能:
决策树:
What are you building?
├── Node.js/Frontend → GitHub: templates/github-actions/node-ci.yml | GitLab: templates/gitlab-ci/node-ci.yml
├── Python → GitHub: templates/github-actions/python-ci.yml | GitLab: templates/gitlab-ci/python-ci.yml
├── Go → GitHub: templates/github-actions/go-ci.yml | GitLab: templates/gitlab-ci/go-ci.yml
├── Docker Image → GitHub: templates/github-actions/docker-build.yml | GitLab: templates/gitlab-ci/docker-build.yml
├── Other → Follow the pipeline design pattern below
基本流水线结构:
# 1. 快速反馈(代码检查、格式化)- <1 分钟
# 2. 单元测试 - 1-5 分钟
# 3. 集成测试 - 5-15 分钟
# 4. 构建产物
# 5. 端到端测试(可选,仅主分支)- 15-30 分钟
# 6. 部署(带审批门控)
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
关键原则:
actions/cache 或 GitLab 缓存详见 best_practices.md 获取全面的流水线设计模式。
快速见效清单:
needs 依赖npm ci 替代 npm install分析现有流水线:
# 使用流水线分析脚本
python3 scripts/pipeline_analyzer.py --platform github --workflow .github/workflows/ci.yml
常见优化:
needs 进行并行化详见 optimization.md 获取详细的缓存策略、并行化技术和性能调优。
基本安全检查清单:
快速设置 - OIDC 认证:
GitHub Actions → AWS:
permissions:
id-token: write
contents: read
steps:
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789:role/GitHubActionsRole
aws-region: us-east-1
密钥管理:
详见 security.md 获取全面的安全模式、供应链安全和密钥管理。
系统化方法:
步骤 1:检查流水线健康状况
python3 scripts/ci_health.py --platform github --repo owner/repo
步骤 2:识别故障类型
| 错误模式 | 常见原因 | 快速修复 |
|---|---|---|
| "Module not found" | 缺少依赖项或缓存问题 | 清除缓存,运行 npm ci |
| "Timeout" | 作业耗时过长 | 添加缓存,增加超时时间 |
| "Permission denied" | 缺少权限 | 添加到 permissions: 块 |
| "Cannot connect to Docker daemon" | Docker 不可用 | 使用正确的运行器或 DinD |
| 间歇性故障 | 不稳定的测试或竞态条件 | 添加重试,修复时序问题 |
步骤 3:启用调试日志记录
GitHub Actions:
# 添加仓库密钥:
# ACTIONS_RUNNER_DEBUG = true
# ACTIONS_STEP_DEBUG = true
GitLab CI:
variables:
CI_DEBUG_TRACE: "true"
步骤 4:本地复现
# GitHub Actions - 使用 act
act -j build
# 或使用 Docker
docker run -it ubuntu:latest bash
# 然后手动运行失败的步骤
详见 troubleshooting.md 获取全面的问题诊断、平台特定问题和解决方案。
部署模式选择:
| 模式 | 使用场景 | 复杂度 | 风险 |
|---|---|---|---|
| 直接部署 | 简单应用,低流量 | 低 | 中等 |
| 蓝绿部署 | 需要零停机时间 | 中等 | 低 |
| 金丝雀部署 | 渐进式发布,需要监控 | 高 | 非常低 |
| 滚动更新 | Kubernetes,容器 | 中等 | 低 |
基本部署结构:
deploy:
needs: [build, test]
if: github.ref == 'refs/heads/main'
environment:
name: production
url: https://example.com
steps:
- name: Download artifacts
- name: Deploy
- name: Health check
- name: Rollback on failure
多环境设置:
详见 best_practices.md 获取详细的部署模式和环境管理。
安全扫描类型:
| 扫描类型 | 目的 | 何时运行 | 速度 | 工具 |
|---|---|---|---|---|
| 密钥扫描 | 查找暴露的凭据 | 每次提交 | 快(<1 分钟) | TruffleHog, Gitleaks |
| SAST | 查找代码漏洞 | 每次提交 | 中等(5-15 分钟) | CodeQL, Semgrep, Bandit, Gosec |
| SCA | 查找依赖项漏洞 | 每次提交 | 快(1-5 分钟) | npm audit, pip-audit, Snyk |
| 容器扫描 | 查找镜像漏洞 | 构建后 | 中等(5-10 分钟) | Trivy, Grype |
| DAST | 查找运行时漏洞 | 计划任务/仅主分支 | 慢(15-60 分钟) | OWASP ZAP |
快速设置 - 为现有流水线添加安全扫描:
GitHub Actions:
jobs:
# 在构建作业之前添加
secret-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: trufflesecurity/trufflehog@main
- uses: gitleaks/gitleaks-action@v2
sast:
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- uses: actions/checkout@v4
- uses: github/codeql-action/init@v3
with:
languages: javascript # 或 python, go
- uses: github/codeql-action/analyze@v3
build:
needs: [secret-scan, sast] # 添加依赖项
GitLab CI:
stages:
- security # 在其他阶段之前添加
- build
- test
# 密钥扫描
secret-scan:
stage: security
image: trufflesecurity/trufflehog:latest
script:
- trufflehog filesystem . --json --fail
# SAST
sast:semgrep:
stage: security
image: returntocorp/semgrep
script:
- semgrep scan --config=auto .
# 使用 GitLab 模板
include:
- template: Security/SAST.gitlab-ci.yml
- template: Security/Dependency-Scanning.gitlab-ci.yml
全面的安全流水线模板:
templates/github-actions/security-scan.yml - 包含所有扫描阶段的完整 DevSecOps 流水线templates/gitlab-ci/security-scan.yml - 包含 GitLab 安全模板的完整 DevSecOps 流水线安全门控模式:
添加一个安全门控作业,评估所有安全扫描结果,并在发现严重问题时使流水线失败:
security-gate:
needs: [secret-scan, sast, sca, container-scan]
script:
# 检查严重漏洞
# 解析 JSON 报告并评估阈值
# 如果发现严重问题则失败
特定语言的安全工具:
所有特定语言模板现在都包含安全扫描阶段。请参阅:
templates/github-actions/node-ci.ymltemplates/github-actions/python-ci.ymltemplates/github-actions/go-ci.ymltemplates/gitlab-ci/node-ci.ymltemplates/gitlab-ci/python-ci.ymltemplates/gitlab-ci/go-ci.yml详见 devsecops.md 获取全面的 DevSecOps 指南,涵盖所有安全扫描类型、工具比较和实施模式。
# 列出工作流
gh workflow list
# 查看近期运行
gh run list --limit 20
# 查看特定运行
gh run view <run-id>
# 重新运行失败的作业
gh run rerun <run-id> --failed
# 下载日志
gh run view <run-id> --log > logs.txt
# 手动触发工作流
gh workflow run ci.yml
# 检查工作流状态
gh run watch
# 查看流水线
gl project-pipelines list
# 流水线状态
gl project-pipeline get <pipeline-id>
# 重试失败的作业
gl project-pipeline retry <pipeline-id>
# 取消流水线
gl project-pipeline cancel <pipeline-id>
# 下载产物
gl project-job artifacts <job-id>
可重用工作流:
# .github/workflows/reusable-test.yml
on:
workflow_call:
inputs:
node-version:
required: true
type: string
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/setup-node@v4
with:
node-version: ${{ inputs.node-version }}
从另一个工作流调用:
jobs:
test:
uses: ./.github/workflows/reusable-test.yml
with:
node-version: '20'
使用 extends 的模板:
.test_template:
image: node:20
before_script:
- npm ci
unit-test:
extends: .test_template
script:
- npm run test:unit
integration-test:
extends: .test_template
script:
- npm run test:integration
使用 needs 的 DAG 流水线:
build:
stage: build
test:unit:
stage: test
needs: [build]
test:integration:
stage: test
needs: [build]
deploy:
stage: deploy
needs: [test:unit, test:integration]
分析工作流配置以寻找优化机会:
# GitHub Actions
python3 scripts/pipeline_analyzer.py --platform github --workflow .github/workflows/ci.yml
# GitLab CI
python3 scripts/pipeline_analyzer.py --platform gitlab --config .gitlab-ci.yml
识别:
检查流水线状态并识别问题:
# GitHub Actions
python3 scripts/ci_health.py --platform github --repo owner/repo --limit 20
# GitLab CI
python3 scripts/ci_health.py --platform gitlab --project-id 12345 --token $GITLAB_TOKEN
提供:
关于特定主题的深入信息:
常见用例的入门模板:
assets/templates/github-actions/node-ci.yml - 包含安全扫描、缓存、矩阵测试和多环境部署的完整 Node.js CI/CDassets/templates/github-actions/python-ci.yml - 包含安全扫描、pytest、覆盖率、PyPI 部署的 Python 流水线assets/templates/github-actions/go-ci.yml - 包含安全扫描、多平台构建、基准测试、集成测试的 Go 流水线assets/templates/github-actions/docker-build.yml - 包含多平台支持、安全扫描、SBOM 生成和签名的 Docker 构建assets/templates/github-actions/security-scan.yml - 包含 SAST、DAST、SCA、容器扫描和安全门控的全面 DevSecOps 流水线assets/templates/gitlab-ci/node-ci.yml - 包含安全扫描、并行执行、服务和部署阶段的 GitLab CI 流水线assets/templates/gitlab-ci/python-ci.yml - 包含安全扫描、并行测试、Docker 构建、PyPI 和 Cloud Run 部署的 Python 流水线assets/templates/gitlab-ci/go-ci.yml - 包含安全扫描、多平台构建、基准测试、Kubernetes 部署的 Go 流水线assets/templates/gitlab-ci/docker-build.yml - 包含 DinD、多架构、容器注册表、安全扫描的 Docker 构建assets/templates/gitlab-ci/security-scan.yml - 包含 SAST、DAST、SCA、容器扫描、GitLab 安全模板和安全门控的全面 DevSecOps 流水线GitHub Actions:
- uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
- run: npm ci
GitLab CI:
cache:
key:
files:
- package-lock.json
paths:
- node_modules/
GitHub Actions:
strategy:
matrix:
os: [ubuntu-latest, macos-latest]
node: [18, 20, 22]
fail-fast: false
GitLab CI:
test:
parallel:
matrix:
- NODE_VERSION: ['18', '20', '22']
GitHub Actions:
- name: Deploy
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
GitLab CI:
deploy:
rules:
- if: '$CI_COMMIT_BRANCH == "main"'
when: manual
性能:
安全:
可靠性:
可维护性:
assets/templates/ 中的模板开始scripts/pipeline_analyzer.pyreferences/troubleshooting.mdreferences/security.md 和 references/devsecops.md 中的清单references/optimization.md每周安装
85
仓库
GitHub 星标
89
首次出现
2026年1月23日
安全审计
安装于
opencode76
gemini-cli70
codex67
claude-code64
github-copilot63
cursor62
Comprehensive guide for CI/CD pipeline design, optimization, security, and troubleshooting across GitHub Actions, GitLab CI, and other platforms.
Use this skill when:
Decision tree:
What are you building?
├── Node.js/Frontend → GitHub: templates/github-actions/node-ci.yml | GitLab: templates/gitlab-ci/node-ci.yml
├── Python → GitHub: templates/github-actions/python-ci.yml | GitLab: templates/gitlab-ci/python-ci.yml
├── Go → GitHub: templates/github-actions/go-ci.yml | GitLab: templates/gitlab-ci/go-ci.yml
├── Docker Image → GitHub: templates/github-actions/docker-build.yml | GitLab: templates/gitlab-ci/docker-build.yml
├── Other → Follow the pipeline design pattern below
Basic pipeline structure:
# 1. Fast feedback (lint, format) - <1 min
# 2. Unit tests - 1-5 min
# 3. Integration tests - 5-15 min
# 4. Build artifacts
# 5. E2E tests (optional, main branch only) - 15-30 min
# 6. Deploy (with approval gates)
Key principles:
actions/cache or GitLab cacheSee best_practices.md for comprehensive pipeline design patterns.
Quick wins checklist:
needs dependenciesnpm ci instead of npm installAnalyze existing pipeline:
# Use the pipeline analyzer script
python3 scripts/pipeline_analyzer.py --platform github --workflow .github/workflows/ci.yml
Common optimizations:
needsSee optimization.md for detailed caching strategies, parallelization techniques, and performance tuning.
Essential security checklist:
Quick setup - OIDC authentication:
GitHub Actions → AWS:
permissions:
id-token: write
contents: read
steps:
- uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::123456789:role/GitHubActionsRole
aws-region: us-east-1
Secrets management:
See security.md for comprehensive security patterns, supply chain security, and secrets management.
Systematic approach:
Step 1: Check pipeline health
python3 scripts/ci_health.py --platform github --repo owner/repo
Step 2: Identify the failure type
| Error Pattern | Common Cause | Quick Fix |
|---|---|---|
| "Module not found" | Missing dependency or cache issue | Clear cache, run npm ci |
| "Timeout" | Job taking too long | Add caching, increase timeout |
| "Permission denied" | Missing permissions | Add to permissions: block |
| "Cannot connect to Docker daemon" | Docker not available | Use correct runner or DinD |
| Intermittent failures | Flaky tests or race conditions | Add retries, fix timing issues |
Step 3: Enable debug logging
GitHub Actions:
# Add repository secrets:
# ACTIONS_RUNNER_DEBUG = true
# ACTIONS_STEP_DEBUG = true
GitLab CI:
variables:
CI_DEBUG_TRACE: "true"
Step 4: Reproduce locally
# GitHub Actions - use act
act -j build
# Or Docker
docker run -it ubuntu:latest bash
# Then manually run the failing steps
See troubleshooting.md for comprehensive issue diagnosis, platform-specific problems, and solutions.
Deployment pattern selection:
| Pattern | Use Case | Complexity | Risk |
|---|---|---|---|
| Direct | Simple apps, low traffic | Low | Medium |
| Blue-Green | Zero downtime required | Medium | Low |
| Canary | Gradual rollout, monitoring | High | Very Low |
| Rolling | Kubernetes, containers | Medium | Low |
Basic deployment structure:
deploy:
needs: [build, test]
if: github.ref == 'refs/heads/main'
environment:
name: production
url: https://example.com
steps:
- name: Download artifacts
- name: Deploy
- name: Health check
- name: Rollback on failure
Multi-environment setup:
See best_practices.md for detailed deployment patterns and environment management.
Security scanning types:
| Scan Type | Purpose | When to Run | Speed | Tools |
|---|---|---|---|---|
| Secret Scanning | Find exposed credentials | Every commit | Fast (<1 min) | TruffleHog, Gitleaks |
| SAST | Find code vulnerabilities | Every commit | Medium (5-15 min) | CodeQL, Semgrep, Bandit, Gosec |
| SCA | Find dependency vulnerabilities | Every commit | Fast (1-5 min) | npm audit, pip-audit, Snyk |
| Container Scanning | Find image vulnerabilities | After build | Medium (5-10 min) | Trivy, Grype |
| DAST | Find runtime vulnerabilities | Scheduled/main only | Slow (15-60 min) | OWASP ZAP |
Quick setup - Add security to existing pipeline:
GitHub Actions:
jobs:
# Add before build job
secret-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: trufflesecurity/trufflehog@main
- uses: gitleaks/gitleaks-action@v2
sast:
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- uses: actions/checkout@v4
- uses: github/codeql-action/init@v3
with:
languages: javascript # or python, go
- uses: github/codeql-action/analyze@v3
build:
needs: [secret-scan, sast] # Add dependencies
GitLab CI:
stages:
- security # Add before other stages
- build
- test
# Secret scanning
secret-scan:
stage: security
image: trufflesecurity/trufflehog:latest
script:
- trufflehog filesystem . --json --fail
# SAST
sast:semgrep:
stage: security
image: returntocorp/semgrep
script:
- semgrep scan --config=auto .
# Use GitLab templates
include:
- template: Security/SAST.gitlab-ci.yml
- template: Security/Dependency-Scanning.gitlab-ci.yml
Comprehensive security pipeline templates:
templates/github-actions/security-scan.yml - Complete DevSecOps pipeline with all scanning stagestemplates/gitlab-ci/security-scan.yml - Complete DevSecOps pipeline with GitLab security templatesSecurity gate pattern:
Add a security gate job that evaluates all security scan results and fails the pipeline if critical issues are found:
security-gate:
needs: [secret-scan, sast, sca, container-scan]
script:
# Check for critical vulnerabilities
# Parse JSON reports and evaluate thresholds
# Fail if critical issues found
Language-specific security tools:
All language-specific templates now include security scanning stages. See:
templates/github-actions/node-ci.ymltemplates/github-actions/python-ci.ymltemplates/github-actions/go-ci.ymltemplates/gitlab-ci/node-ci.ymltemplates/gitlab-ci/python-ci.ymltemplates/gitlab-ci/go-ci.ymlSee devsecops.md for comprehensive DevSecOps guide covering all security scanning types, tool comparisons, and implementation patterns.
# List workflows
gh workflow list
# View recent runs
gh run list --limit 20
# View specific run
gh run view <run-id>
# Re-run failed jobs
gh run rerun <run-id> --failed
# Download logs
gh run view <run-id> --log > logs.txt
# Trigger workflow manually
gh workflow run ci.yml
# Check workflow status
gh run watch
# View pipelines
gl project-pipelines list
# Pipeline status
gl project-pipeline get <pipeline-id>
# Retry failed jobs
gl project-pipeline retry <pipeline-id>
# Cancel pipeline
gl project-pipeline cancel <pipeline-id>
# Download artifacts
gl project-job artifacts <job-id>
Reusable workflows:
# .github/workflows/reusable-test.yml
on:
workflow_call:
inputs:
node-version:
required: true
type: string
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/setup-node@v4
with:
node-version: ${{ inputs.node-version }}
Call from another workflow:
jobs:
test:
uses: ./.github/workflows/reusable-test.yml
with:
node-version: '20'
Templates with extends:
.test_template:
image: node:20
before_script:
- npm ci
unit-test:
extends: .test_template
script:
- npm run test:unit
integration-test:
extends: .test_template
script:
- npm run test:integration
DAG pipelines with needs:
build:
stage: build
test:unit:
stage: test
needs: [build]
test:integration:
stage: test
needs: [build]
deploy:
stage: deploy
needs: [test:unit, test:integration]
Analyzes workflow configuration for optimization opportunities:
# GitHub Actions
python3 scripts/pipeline_analyzer.py --platform github --workflow .github/workflows/ci.yml
# GitLab CI
python3 scripts/pipeline_analyzer.py --platform gitlab --config .gitlab-ci.yml
Identifies:
Checks pipeline status and identifies issues:
# GitHub Actions
python3 scripts/ci_health.py --platform github --repo owner/repo --limit 20
# GitLab CI
python3 scripts/ci_health.py --platform gitlab --project-id 12345 --token $GITLAB_TOKEN
Provides:
For deep-dive information on specific topics:
Starter templates for common use cases:
assets/templates/github-actions/node-ci.yml - Complete Node.js CI/CD with security scanning, caching, matrix testing, and multi-environment deploymentassets/templates/github-actions/python-ci.yml - Python pipeline with security scanning, pytest, coverage, PyPI deploymentassets/templates/github-actions/go-ci.yml - Go pipeline with security scanning, multi-platform builds, benchmarks, integration testsassets/templates/github-actions/docker-build.yml - Docker build with multi-platform support, security scanning, SBOM generation, and signingassets/templates/github-actions/security-scan.yml - Comprehensive DevSecOps pipeline with SAST, DAST, SCA, container scanning, and security gatesassets/templates/gitlab-ci/node-ci.yml - GitLab CI pipeline with security scanning, parallel execution, services, and deployment stagesassets/templates/gitlab-ci/python-ci.yml - Python pipeline with security scanning, parallel testing, Docker builds, PyPI and Cloud Run deploymentassets/templates/gitlab-ci/go-ci.yml - Go pipeline with security scanning, multi-platform builds, benchmarks, Kubernetes deploymentassets/templates/gitlab-ci/docker-build.yml - Docker build with DinD, multi-arch, Container Registry, security scanningassets/templates/gitlab-ci/security-scan.yml - Comprehensive DevSecOps pipeline with SAST, DAST, SCA, container scanning, GitLab security templates, and security gatesGitHub Actions:
- uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
restore-keys: |
${{ runner.os }}-node-
- run: npm ci
GitLab CI:
cache:
key:
files:
- package-lock.json
paths:
- node_modules/
GitHub Actions:
strategy:
matrix:
os: [ubuntu-latest, macos-latest]
node: [18, 20, 22]
fail-fast: false
GitLab CI:
test:
parallel:
matrix:
- NODE_VERSION: ['18', '20', '22']
GitHub Actions:
- name: Deploy
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
GitLab CI:
deploy:
rules:
- if: '$CI_COMMIT_BRANCH == "main"'
when: manual
Performance:
Security:
Reliability:
Maintainability:
assets/templates/scripts/pipeline_analyzer.pyreferences/troubleshooting.mdreferences/security.md and references/devsecops.md checklistsreferences/optimization.mdWeekly Installs
85
Repository
GitHub Stars
89
First Seen
Jan 23, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
opencode76
gemini-cli70
codex67
claude-code64
github-copilot63
cursor62
Azure Data Explorer (Kusto) 查询技能:KQL数据分析、日志遥测与时间序列处理
130,600 周安装