building-cicd-configs — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited building-cicd-configs (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Check for framework indicators:
| Framework | Indicators |
|---|---|
| Next.js | next.config.*, "next" in package.json |
| Nuxt | nuxt.config.*, "nuxt" in package.json |
| Vite | vite.config.*, "vite" in package.json |
| Node.js | package.json without frontend framework |
| Static | index.html at root, no package.json |
| Python | requirements.txt, pyproject.toml, setup.py |
Detect package manager:
ls package-lock.json yarn.lock pnpm-lock.yaml bun.lockb 2>/dev/null | head -1Check for existing scripts:
npm pkg get scripts 2>/dev/nullCheck for existing configs:
ls -la .github/workflows/ .gitlab-ci.yml .circleci/config.yml 2>/dev/nullPlatform selection:
.github/workflows/*.yml.gitlab-ci.yml.circleci/ exists or user specifiesStandard pipeline flow:
install → lint → test → build → deployRequired stages based on project:
linttestbuilddeployGitHub Actions (Node.js/Next.js):
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
ci:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
cache: "npm"
- name: Install dependencies
run: npm ci
- name: Lint
run: npm run lint
- name: Test
run: npm test
- name: Build
run: npm run buildGitHub Actions (with matrix):
jobs:
ci:
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [18, 20, 22]
steps:
- uses: actions/checkout@v4
- name: Setup Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
cache: "npm"
- run: npm ci
- run: npm run lint
- run: npm testGitLab CI:
stages:
- install
- lint
- test
- build
variables:
npm_config_cache: "$CI_PROJECT_DIR/.npm"
cache:
paths:
- .npm/
- node_modules/
install:
stage: install
image: node:20
script:
- npm ci
lint:
stage: lint
image: node:20
script:
- npm run lint
test:
stage: test
image: node:20
script:
- npm test
coverage: '/All files[^|]*\|[^|]*\s+([\d\.]+)/'
build:
stage: build
image: node:20
script:
- npm run build
artifacts:
paths:
- dist/CircleCI:
version: 2.1
orbs:
node: circleci/node@5
jobs:
build-and-test:
executor:
name: node/default
tag: "20"
steps:
- checkout
- node/install-packages
- run:
name: Lint
command: npm run lint
- run:
name: Test
command: npm test
- run:
name: Build
command: npm run build
workflows:
ci:
jobs:
- build-and-testVercel (GitHub Actions):
deploy:
needs: ci
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v4
- uses: amondnet/vercel-action@v25
with:
vercel-token: ${{ secrets.VERCEL_TOKEN }}
vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
vercel-args: "--prod"AWS S3 (GitHub Actions):
deploy:
needs: ci
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v4
- run: npm ci && npm run build
- uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1
- run: aws s3 sync ./dist s3://${{ secrets.S3_BUCKET }} --deleteGitHub Actions:
# Install actionlint
brew install actionlint
actionlint .github/workflows/*.ymlGitLab CI:
# Use GitLab's CI Lint API or local validation
gitlab-ci-lint .gitlab-ci.ymlCircleCI:
circleci config validate .circleci/config.ymlYAML syntax check:
npx yaml-lint .github/workflows/*.ymlEnvironment variables:
env:
NODE_ENV: production
CI: trueCaching (GitHub Actions):
- uses: actions/cache@v4
with:
path: ~/.npm
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}Conditional jobs:
if: github.event_name == 'push' && github.ref == 'refs/heads/main'Secrets reference:
${{ secrets.SECRET_NAME }}Before completing:
on: triggers match.@v4 not @v5).actionlint or YAML linter locally.--help on CLI tools.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.