Stand ci

Canonical Agent Skills library for Claude Code, Cursor, Codex, and other agents.

Install

npx -y skills add lgtm-hq/ai-skills --skill stand-ci

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

CI/CD and GitHub Actions guidelines. Use when writing workflows or Actions. Shell script code must be in dedicated .sh or .py files. Actions must be pinned to SHAs, not versions.

SKILL.md

3.2 KB, as published. Nobody here has run it

CI/CD Standards

Standards for CI/CD pipelines and GitHub Actions.

GitHub Actions / Workflows

Shell script code should NOT be inline in Actions/Workflow YAML files
Extract scripts to dedicated .sh or .py files in a scripts/ directory
Reference these scripts from the workflow
ALWAYS pin actions to full commit SHAs, NOT version tags

Action Pinning

Actions MUST be pinned to SHA hashes for security and reproducibility:

# WRONG - version tag (can be moved, vulnerable to supply chain attacks)
- uses: actions/checkout@v4
- uses: actions/setup-python@v5

# CORRECT - pinned to SHA (immutable, secure)
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0

Finding SHAs

Go to the action's releases page
Click on the version tag
Copy the full commit SHA
Add version as comment for readability

Why

Easier to test scripts locally
Better syntax highlighting and linting
Reusable across workflows
Cleaner workflow files
Proper version control diffs

Examples

# WRONG - inline script in workflow
jobs:
  build:
    steps:
      - name: Build and deploy
        run: |
          echo "Building..."
          npm install
          npm run build
          if [ -f dist/index.js ]; then
            aws s3 sync dist/ s3://bucket/
          fi

# CORRECT - reference external script
jobs:
  build:
    steps:
      - name: Build and deploy
        run: ./scripts/ci/build-and-deploy.sh

Script Organization

scripts/
└── ci/
    ├── build.sh
    ├── deploy.sh
    ├── test.sh
    └── utils/
        └── helpers.py

Script Requirements

Scripts must be executable (chmod +x)
Include shebang line (#!/usr/bin/env bash or #!/usr/bin/env python3)
Follow shell script best practices (set -euo pipefail for bash)

No Hand-Maintained Mirrors of Canonical Sources

If CI needs to verify that two files agree on the same value, the second file is a derived artifact — generate it, don't validate it.

Replace verify-X-sync.py scripts with generate-X.py; CI runs the generator with --check (exit 1 + unified diff on drift) instead of parsing both files and comparing.
The same generator runs locally for the writer flow and in CI for the gate flow — a single code path, no parser duplication.
Generators consumed by automation (e.g. Renovate postUpgradeTasks) should be stdlib-only so they run in any minimal container without dep installation.
Treat automation hooks as convenience, not correctness. The --check gate is the truth-keeper; if the hook silently fails, CI still catches the drift.

# WRONG — verify two files agree
- run: python3 scripts/ci/verify-manifest-sync.py
- run: python3 scripts/ci/verify-tool-version-sync.py

# CORRECT — single generator, single check
- run: python3 scripts/ci/generate-tool-versions.py --check

Gives 1 of the 12 instructions most ci cd skills give

Counted across 392 of the 394 authors here whose files we hold, read 2026-08-06

pin third-party actions to full commit SHAshere, and in 33 of 392
cache dependencies appropriatelyin 24 of 392, across 12 files
optimize pipelines exceeding ten minutesin 20 of 392, across 6 files
enforce all quality gates before mergein 20 of 392, across 7 files
Configure branch protection rulesin 19 of 392, across 5 files
use environments for deployment trackingin 19 of 392, across 7 files
implement manual gates for productionin 19 of 392, across 7 files
implement security scanningin 18 of 392, across 5 files
fix failing code instead of disabling checksin 18 of 392, across 4 files
use CI/CD variables for secretsin 18 of 392, across 6 files
move checks upstream in the pipelinein 17 of 392, across 3 files
use specific image tagsin 17 of 392, across 5 files

Said here and by no other author read

extract shell scripts to dedicated files
add the version tag as a comment
make scripts executable
include a shebang line
use strict error handling in bash
generate derived artifacts instead of validating sync

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.