Stand ci

CI/CD and GitHub Actions guidelines. Use when writing workflows or Actions. Shell script code must be in dedicated .sh or .py files. Actions must be pinned to SHAs, not versions.From its SKILL.md

Install

npx -y skills add lgtm-hq/ai-skills --skill stand-ci

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.2 KB, 777 tokens by cl100k_base, as published. Nobody here has run it

CI/CD Standards

Standards for CI/CD pipelines and GitHub Actions.

GitHub Actions / Workflows

Shell script code should NOT be inline in Actions/Workflow YAML files
Extract scripts to dedicated .sh or .py files in a scripts/ directory
Reference these scripts from the workflow
ALWAYS pin actions to full commit SHAs, NOT version tags

Action Pinning

Actions MUST be pinned to SHA hashes for security and reproducibility:

# WRONG - version tag (can be moved, vulnerable to supply chain attacks)
- uses: actions/checkout@v4
- uses: actions/setup-python@v5

# CORRECT - pinned to SHA (immutable, secure)
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0

Finding SHAs

Go to the action's releases page
Click on the version tag
Copy the full commit SHA
Add version as comment for readability

Why

Easier to test scripts locally
Better syntax highlighting and linting
Reusable across workflows
Cleaner workflow files
Proper version control diffs

Examples

# WRONG - inline script in workflow
jobs:
  build:
    steps:
      - name: Build and deploy
        run: |
          echo "Building..."
          npm install
          npm run build
          if [ -f dist/index.js ]; then
            aws s3 sync dist/ s3://bucket/
          fi

# CORRECT - reference external script
jobs:
  build:
    steps:
      - name: Build and deploy
        run: ./scripts/ci/build-and-deploy.sh

Script Organization

scripts/
└── ci/
    ├── build.sh
    ├── deploy.sh
    ├── test.sh
    └── utils/
        └── helpers.py

Script Requirements

Scripts must be executable (chmod +x)
Include shebang line (#!/usr/bin/env bash or #!/usr/bin/env python3)
Follow shell script best practices (set -euo pipefail for bash)

No Hand-Maintained Mirrors of Canonical Sources

If CI needs to verify that two files agree on the same value, the second file is a derived artifact — generate it, don't validate it.

Replace verify-X-sync.py scripts with generate-X.py; CI runs the generator with --check (exit 1 + unified diff on drift) instead of parsing both files and comparing.
The same generator runs locally for the writer flow and in CI for the gate flow — a single code path, no parser duplication.
Generators consumed by automation (e.g. Renovate postUpgradeTasks) should be stdlib-only so they run in any minimal container without dep installation.
Treat automation hooks as convenience, not correctness. The --check gate is the truth-keeper; if the hook silently fails, CI still catches the drift.

# WRONG — verify two files agree
- run: python3 scripts/ci/verify-manifest-sync.py
- run: python3 scripts/ci/verify-tool-version-sync.py

# CORRECT — single generator, single check
- run: python3 scripts/ci/generate-tool-versions.py --check

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 1 of the 12 instructions most ci cd skills give in 777 tokens

Counted across 343 of the 355 authors here whose files we hold, read 2026-09-06

Pin third-party actions to full commit SHAhere, and in 34 of 343, across 29 files
Set timeout-minutes on every jobin 23 of 343, across 17 files
Deploy to staging before productionin 18 of 343
Use OIDC instead of stored cloud credentialsin 18 of 343, across 12 files
Pin action versionsin 14 of 343, across 13 files
Cache dependencies keyed on the lockfile hashin 14 of 343, across 13 files
Declare least-privilege permissions at workflow and job levelin 13 of 343, across 7 files
Pass untrusted values through env variablesin 13 of 343, across 9 files
Create efficient GitHub Actions workflowsin 11 of 343, across 5 files
Cache dependencies via setup actions or actions/cachein 11 of 343, across 5 files
Cache dependencies to speed up buildsin 11 of 343
Store secrets in secret managersin 11 of 343, across 10 files

Said here and by no other author read

Extract shell code into dedicated .sh or .py files
Reference extracted scripts from the workflow
Make scripts executable
Include a shebang line
Generate derived files instead of verifying them
Run generators with --check in CI

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.