create-pipeline-v1 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited create-pipeline-v1 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate Harness v1 simplified Pipeline YAML and optionally push to Harness via MCP.
Alpha: This skill is currently in internal testing only.
/create-pipeline) if unclear.references/v1-spec-schema.md for the complete v1 schema, step types, action catalog, and examplesrun: steps. Consult references/native-actions.md for the full mapping. Key rules:template: uses: buildAndPushToDocker / buildAndPushToECR / buildAndPushToGAR (never run: docker build && docker push)action: uses: kubernetes-rolling-deploy or template: uses: k8sRollingDeployStep (never run: kubectl apply)action: uses: helm-deploy or template: uses: helmDeployBasicStep (never run: helm upgrade --install)template: uses: ecsBluegreenDeployStep (never run: aws ecs update-service)template: uses: terraformStep (never run: terraform apply)gitleaksStep, banditStep, sbomOrchestrationStep)template: uses: uploadArtifactsToS3 / uploadArtifactsToGCS (never run: aws s3 cp)approval: uses: harness or approval: uses: jira (never polling scripts)action: uses: jira-create / snow-create (never run: curl)action: uses: http or template: uses: httpStep (never run: curl)run: steps only for custom build/test/lint commands with no native equivalent${{ }} expressions, script field for run steps, and action/template steps for deploymentsharness_create with resource_type pipeline| v0 Syntax | v1 Syntax |
|---|---|
<+variable> expressions | ${{ variable }} expressions |
type: CI / type: Deployment stage types | Flat stages -- no type field |
command: field in Run steps | script: field in run: steps |
Native steps (K8sRollingDeploy, HelmDeploy) | Action steps (action: uses: kubernetes-rolling-deploy) |
failureStrategies: | on-failure: |
HarnessApproval step type | approval: uses: harness (stage-level or inline) |
Deep nesting (spec: execution: steps:) | Flat structure (steps:) |
strategy: matrix: under stage spec | strategy: matrix: directly on stage or step |
pipeline:
name: My Pipeline
repo: # optional: repository config
connector: account.github
name: myorg/my-repo
clone: # optional: clone config
depth: 1
on: # optional: event triggers
- push:
branches: [main]
env: # optional: global env vars
NODE_ENV: production
inputs: # optional: pipeline inputs
branch:
type: string
default: main
stages:
- name: build
steps:
- run:
script: go buildNo version:, kind:, or spec: wrapper -- pipeline: is the root key.
Stages have no type field. Their purpose is determined by their keys.
- name: build
runtime: cloud
platform:
os: linux
arch: arm
cache:
path: node_modules
key: npm.${{ branch }}
steps:
- run:
script: npm ci- name: deploy
service: my-service
environment: staging
steps:
- action:
uses: kubernetes-rolling-deploy
with:
dry-run: false- approval:
uses: harness
with:
timeout: 30m
message: "Approve deployment?"
groups: [admins, ops]
min-approvers: 1Uses script: field (not command: or run:).
# long syntax
- run:
script: npm test
# short syntax
- run: npm test
# with container
- run:
container: node:18
script: npm test
# with shell and env
- run:
shell: bash
script: |
npm ci
npm test
env:
NODE_ENV: test
# with output variables
- id: build
run:
script: echo "TAG=v1" >> $HARNESS_OUTPUT
output: [TAG]- run-test:
container: maven
script: mvn test
report:
type: junit
path: target/surefire-reports/*.xml
splitting:
concurrency: 4Actions replace v0 native steps. See references/v1-spec-schema.md for the full action catalog.
# Kubernetes deploy
- action:
uses: kubernetes-rolling-deploy
with:
dry-run: false
# Helm deploy
- action:
uses: helm-deploy
with:
timeout: 10m
# Terraform plan
- action:
uses: terraform-plan
with:
command: apply
aws-provider: account.aws_connector
# HTTP request
- action:
uses: http
with:
method: GET
endpoint: https://acme.com- background:
container: redis
- run:
script: npm test- template:
uses: [email protected]
with:
push: true
tags: latest- approval:
uses: jira
with:
connector: account.jira
project: PROJ# parallel steps
- parallel:
steps:
- run:
script: npm run lint
- run:
script: npm test
# parallel stages
- parallel:
stages:
- steps:
- run: go test
- steps:
- run: npm test
# step group
- group:
steps:
- run:
script: go build
- run:
script: go test# matrix (stage-level)
- strategy:
matrix:
node: [16, 18, 20]
os: [linux, macos]
max-parallel: 3
steps:
- run:
container: node:${{ matrix.node }}
script: npm test
# matrix (step-level)
- strategy:
matrix:
go: [1.19, 1.20, 1.21]
run:
container: golang:${{ matrix.go }}
script: go test# step-level
- run:
script: go test
on-failure:
errors: all
action: ignore # abort, ignore, retry, fail, success
# retry with attempts
- run:
script: go test
on-failure:
errors: [unknown]
action:
retry:
attempts: 5
interval: 10s
failure-action: fail
# stage-level
- steps:
- run:
script: go test
on-failure:
errors: all
action: abort# stage conditional
- if: ${{ branch == "main" }}
steps:
- run:
script: deploy.sh
# step conditional
- if: ${{ branch == "main" }}
run:
script: deploy.shpipeline:
repo:
connector: account.github
name: myorg/my-app
clone:
depth: 1
on:
- push:
branches: [main]
- pull_request:
branches: [main]
stages:
- name: build-and-test
runtime: cloud
platform:
os: linux
arch: arm
cache:
path: node_modules
key: npm.${{ branch }}
steps:
- run:
script: npm ci
- parallel:
steps:
- run:
script: npm run lint
- run-test:
script: npm test
report:
type: junit
path: junit.xml
- action:
uses: docker-build-push
with:
connector: dockerhub
repo: myorg/my-app
tags: [${{ pipeline.sequenceId }}, latest]pipeline:
inputs:
skip_dry_run:
type: boolean
default: false
stages:
- name: deploy-staging
service: petstore
environment: staging
steps:
- action:
uses: manifest-download
- action:
uses: manifest-bake
- action:
uses: kubernetes-rolling-deploy
with:
dry-run: ${{ inputs.skip_dry_run }}
- approval:
uses: harness
with:
timeout: 1d
message: "Approve production deployment?"
groups: [prod-approvers]
min-approvers: 1
- name: deploy-prod
service: petstore
environment: prod
steps:
- action:
uses: manifest-download
- action:
uses: manifest-bake
- action:
uses: kubernetes-rolling-deploy
with:
dry-run: falseharness_list (resource_type: project, org_id) to confirm. If the project does not exist, create it first with harness_create (resource_type: project, body: { identifier, name }) or ask the user.harness_create with the v1 pipeline YAML serialized as a `yamlPipeline` string in the body. Do not pass a nested JSON pipeline object; it causes serialization errors.Call MCP tool: harness_create
Parameters:
resource_type: "pipeline"
org_id: "<organization>"
project_id: "<project>"
body: { yamlPipeline: "<full v1 pipeline YAML string, including 'pipeline:' root key>" }/create-pipeline-v1
Create a v1 CI pipeline for a Node.js app with caching, parallel lint and test, and Docker push/create-pipeline-v1
Create a v1 Kubernetes deployment pipeline with staging approval and production stages/create-pipeline-v1
Create a v1 pipeline that tests across Go 1.19, 1.20, and 1.21 using matrix strategyreferences/native-actions.md before using a run: step. Native actions provide better error handling, rollback support, and UI integration.references/v1-spec-schema.md for the complete v1 spec before generating YAML.script: field in run steps, never command: or run: as the field name.action: uses: or template: uses: for deployments, never v0 native step types like K8sRollingDeploy.<+...> expressions, no type: on stages, no spec: wrapper.${{ }} syntax before presenting.<+...> instead of ${{ ... }} expressionstype: field on stages (v1 stages have no type)command: or run: as the field name instead of script:version:, kind:, spec: (v1 uses bare pipeline:)K8sRollingDeploy) instead of actions (action: uses: kubernetes-rolling-deploy)failureStrategies: instead of on-failure:harness_list (resource_type: project, org_id). Create it first or confirm org_id/project_id are correct.{ yamlPipeline: "<full v1 pipeline YAML string>" } instead of a nested JSON pipeline object.DUPLICATE_IDENTIFIER — Pipeline exists; use harness_updateINVALID_REQUEST — Check YAML structure matches v1 schema~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.