ci

CI/CD Standards

Guidance for implementing compliant CI/CD pipelines that meet SDLC requirements.

Tooling

Available Tools: If using Claude Code, the gh:ci-assist skill can help migrate and configure CI pipelines. Also see gh:migrate for CI/CD migration from other platforms.

Pipeline Trigger Requirements

When CI MUST Run

CI MUST run on:

• All pull requests to protected branches
• All pushes to protected branches (develop, main)
• Scheduled intervals (daily/weekly for security scans)

Concurrency Controls (MUST)

CI MUST implement concurrency controls to cancel superseded runs:

# GitHub Actions example
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Required Pipeline Jobs

Job Order (MUST)

CI pipelines MUST include these jobs in order:

All Jobs Must Pass (MUST)

All CI jobs MUST pass before a PR can be merged. Configure branch protection to enforce this.

CI Configuration Requirements

Pinned Action Versions (MUST)

CI workflows MUST use pinned action versions. Prefer commit SHAs over tags:

# Good - SHA pinned
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0

# Acceptable - tag pinned
- uses: actions/[email protected]

# Bad - floating tag
- uses: actions/checkout@v4

Caching (MUST)

CI MUST cache dependencies and build artifacts:

# Example: Rust caching
- uses: actions/cache@v4
  with:
    path: |
      ~/.cargo/bin/
      ~/.cargo/registry/index/
      ~/.cargo/registry/cache/
      target/
    key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

Multi-Platform Testing (MUST)

CI MUST test on all supported operating systems and architectures:

strategy:
  matrix:
    os: [ubuntu-latest, macos-latest, windows-latest]
    # Add architecture if cross-compiling

CI Environment Requirements

Explicit Configuration (MUST)

CI environment variables MUST be explicitly configured (no reliance on runner defaults):

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  CI: true

Secrets Management (MUST)

Sensitive values MUST be stored as secrets, never in workflow files:

# Good
env:
  API_KEY: ${{ secrets.API_KEY }}

# Bad - never do this
env:
  API_KEY: "sk-abc123..."

Minimal Permissions (MUST)

CI MUST use minimal permissions (principle of least privilege):

permissions:
  contents: read
  pull-requests: write # Only if needed

Implementation Checklist

• Configure CI to run on PRs and protected branch pushes
• Set up scheduled security scans
• Implement all required jobs in correct order
• Pin action versions (preferably SHA)
• Configure caching for dependencies
• Set up multi-platform matrix
• Explicitly configure environment variables
• Store secrets securely
• Apply minimal permissions
• Enable concurrency controls

Compliance Verification

# Verify CI workflow exists
ls -la .github/workflows/

# Check for pinned versions (should see SHA or exact version)
grep -E "uses:.*@" .github/workflows/*.yml

# Verify permissions are set
grep -A5 "permissions:" .github/workflows/*.yml

# Check for secrets usage (should not see hardcoded values)
grep -E "(API_KEY|TOKEN|SECRET)" .github/workflows/*.yml

GitHub Actions Workflow Template

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  schedule:
    - cron: "0 0 * * *" # Daily security scan

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  CI: true

jobs:
  format:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Check formatting
        run: make format-check

  lint:
    runs-on: ubuntu-latest
    needs: format
    steps:
      - uses: actions/checkout@v4
      - name: Lint
        run: make lint-strict

  test:
    runs-on: ${{ matrix.os }}
    needs: lint
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    steps:
      - uses: actions/checkout@v4
      - name: Test
        run: make test

  security:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
      - name: Security audit
        run: make audit

See references/ci-workflows.md for complete workflow templates.

Additional Resources

Reference Files

• references/ci-workflows.md - Complete CI workflow templates
• references/ci-caching.md - Caching strategies by language

Examples

• examples/ci-rust.yml - Rust CI workflow
• examples/ci-typescript.yml - TypeScript CI workflow
• examples/ci-python.yml - Python CI workflow
• examples/ci-java.yml - Java CI workflow