---
name: cicd-auditor
description: Review and audit CI/CD pipeline configurations — GitHub Actions, GitLab CI, Jenkins, CircleCI — for correctness, security, performance, and production readiness.
---

## Trigger Phrases
Use this skill when the request involves reviewing or improving a CI/CD pipeline:

- "Review this GitHub Actions workflow for issues."
- "Why are my builds so slow? Here's the workflow."
- "Audit this GitLab CI pipeline for security problems."
- "Are there any secrets exposed in this workflow?"
- "How do I add proper caching to this pipeline?"
- "This Jenkinsfile is a mess — review it."
- "My pipeline always runs all stages even when nothing changed."

Do not use this skill to generate new pipelines from scratch — use `github-actions-generator` or `gitlab-ci-generator` for that.

## Deterministic Execution Flow

### Stage 0: Identify Pipeline System

| System | Config file | Key patterns |
|--------|-------------|-------------|
| GitHub Actions | `.github/workflows/*.yml` | `on:`, `jobs:`, `steps:`, `uses:` |
| GitLab CI | `.gitlab-ci.yml` | `stages:`, `script:`, `needs:`, `rules:` |
| Jenkins | `Jenkinsfile` | `pipeline {}`, `stages {}`, `agent {}` |
| CircleCI | `.circleci/config.yml` | `workflows:`, `jobs:`, `orbs:` |
| Bitbucket Pipelines | `bitbucket-pipelines.yml` | `pipelines:`, `steps:`, `caches:` |

### Stage 1: Classify Review Scope

| Mode | User intent | Focus areas |
|------|-------------|-------------|
| `security` | Find credential leaks, permission issues | Secrets, permissions, third-party actions |
| `performance` | Speed up the pipeline | Caching, parallelism, conditional execution |
| `correctness` | Find broken or unreliable steps | Job order, dependencies, error handling |
| `full-audit` | Comprehensive review | All of the above |

Default to `full-audit` if no specific scope is stated.

### Stage 2: Security Audit Checklist

**Secrets and credentials:**
- [ ] No hardcoded secrets, tokens, or passwords in any `run:` step, environment variable, or `args:`
- [ ] Secrets accessed via `${{ secrets.NAME }}` (GitHub Actions), `$VARIABLE` from CI variables (GitLab), `credentials()` (Jenkins)
- [ ] `ACTIONS_STEP_DEBUG` or verbose logging flags not left enabled in production workflows
- [ ] `env:` blocks that print variables do not include secret values (`echo $SECRET` to logs is a leak)

**Third-party actions (GitHub Actions specific):**
- [ ] All `uses:` actions are pinned to a commit SHA, not a mutable tag like `@v3` or `@main`
  - Mutable tags can be hijacked; SHA pins prevent supply-chain attacks
  - Example of risky: `uses: actions/checkout@v4`
  - Example of safe: `uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683`
- [ ] Third-party actions (non `actions/*`, non `github/*`) are reviewed before use

**Permissions:**
- [ ] `permissions:` block is set at workflow or job level to restrict GITHUB_TOKEN scope
- [ ] No `permissions: write-all` unless specifically justified
- [ ] Jobs that only read code use `permissions: contents: read`

**Runner security:**
- [ ] Self-hosted runners are not used for public repository workflows (code execution risk)
- [ ] `pull_request_target` trigger is not combined with code checkout from the PR (known attack vector)

### Stage 3: Performance Audit Checklist

**Caching:**
- [ ] Dependency caches configured for package managers present in the pipeline
  - npm/yarn → `actions/cache` with `node_modules` or lockfile hash key
  - pip → cache `~/.cache/pip` keyed on `requirements*.txt`
  - Go modules → cache `~/go/pkg/mod` keyed on `go.sum`
  - Maven → cache `~/.m2`
- [ ] Docker layer caching enabled (`cache-from`, `cache-to` in `docker/build-push-action`)
- [ ] Cache keys use file hashes, not static strings (stale caches cause subtle failures)

**Parallelism:**
- [ ] Jobs that don't depend on each other run in parallel (`needs:` graph is minimal)
- [ ] Test suites split across matrix jobs where applicable
- [ ] No sequential stages where all steps are independent

**Conditional execution:**
- [ ] Docs-only changes skip build/test/deploy jobs (`paths:` filter on triggers)
- [ ] Deploy jobs run only on specific branches (`if: github.ref == 'refs/heads/main'`)
- [ ] Expensive steps (security scans, integration tests) skipped on draft PRs where appropriate

**Timeouts:**
- [ ] `timeout-minutes:` set on jobs and steps — prevents runaway jobs from consuming quota
- [ ] `cancel-in-progress: true` set on `concurrency:` group for PR workflows

### Stage 4: Correctness Audit Checklist

**Job dependencies:**
- [ ] `needs:` correctly models the dependency graph — no job that requires outputs from another runs in parallel with it
- [ ] `outputs:` are correctly defined and consumed by downstream jobs

**Error handling:**
- [ ] Critical steps do not have `continue-on-error: true` silently set
- [ ] `if: always()` is used appropriately for cleanup steps, not as a way to ignore failures

**Environment and variable scope:**
- [ ] `env:` variables at workflow level vs. job level vs. step level are correctly scoped
- [ ] Matrix variables are not accidentally overriding job-level environment variables

**Trigger configuration:**
- [ ] Workflows triggered on `push` to `main` also have `workflow_dispatch:` for manual runs
- [ ] `on: push` without branch filter triggers on every branch (usually unintentional)

### Stage 5: Respond

Format each finding as:
```
[CRITICAL] Line 34 — Secret printed to log: `run: echo $API_KEY` exposes the secret value in the job log.

[WARNING] Line 12 — Third-party action `crazy-max/ghaction-docker-buildx@v3` pinned to mutable tag, not SHA. Can be hijacked.

[PERFORMANCE] Lines 45-67 — No dependency cache configured. npm install runs from scratch on every job. Add `actions/cache` with key on `package-lock.json` hash.

[INFO] Line 8 — `timeout-minutes` not set. Long-running jobs will consume unlimited runner minutes.
```

Close with:
```
## Audit Summary
- Critical security issues: N
- Warnings: N
- Performance improvements available: N
- The pipeline [passes / does not pass] security review as-is.
```

## Done Criteria
- Pipeline system is identified before reviewing.
- Security, performance, and correctness checks are all evaluated for `full-audit` mode.
- Third-party action SHA pinning is explicitly checked for GitHub Actions workflows.
- Every finding includes line reference (or block reference) and explanation of why it matters.
- Performance findings include the exact caching configuration to add, not just "add caching."
- Audit closes with a summary and explicit pass/fail on security review.