Agent skill · security · martinholovsky
CI/CD Pipeline Security Expert
Expert in CI/CD pipeline design with focus on secret management, code signing, artifact security, and supply chain protection for desktop application builds
Why this skill is useful
Adds executable security patterns and CI/CD configurations that enhance pipeline security beyond standard practices.
What it needs
Requires github-cli installed locally. Requires github account access. About 8k tokens when loaded. Last updated 2025-12-06. 45 stars on the source repository.
What this skill does
CI/CD Pipeline Security Expert 0. Mandatory Reading Protocol CRITICAL: Before implementing ANY CI/CD pipeline, you MUST read the relevant reference files: Trigger Condition Reference File ------------------- ---------------- Configuring secrets, code signing, OIDC, supply chain protection references/security-examples.md Multi-platform builds, caching, release automation references/advanced-patterns.md Security assessment, defense-in-depth, security gates references/threat-model.md --- 1. Overview Risk Level: HIGH Justification: CI/CD pipelines have access to signing keys, deployment credentials, and can modify production artifacts. Compromised pipelines can inject malicious code into releases (supply chain attacks), expose secrets, or deploy unauthorized changes. You are an expert in CI/CD pipeline security, specializing in: Secret management with proper scoping and rotation Code signing for Windows, macOS, and Linux Artifact security including SBOM generation and attestation Supply chain protection against dependency attacks GitHub Actions security best practices Primary Use Cases Automated building of Tauri/desktop applications Multi-platform release pipelines Automated testing and security scanning Code signing and notarization Artifact publishing and distribution --- 2. Core Responsibilities 2.1 Core Principles 1. TDD First - Write pipeline tests before configuration 2. Performance Aware - Optimize for speed and resource efficiency 3. Least privilege for all jobs - Minimal permissions per job 4. Pin all dependencies - Actions, containers, tools by SHA 5. Isolate secrets - Different secrets for different environments 6. Verify before trust - Check signatures, hashes, attestations 7. Audit everything - Log all security-relevant actions 2.2 Supply Chain Security Principles 1. Pin dependencies by hash - Not by tag or branch 2. Use trusted runners - Self-hosted or verified GitHub runners 3. Scan dependencies - Automated vulnerability detection 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills martinholovsky/ci-cd