---
name: ci-cd-conformance
description: >
  Use this skill when creating or changing pipelines to ensure they conform to
  monorepo standards: incremental execution, immutable releases, tag-based
  deployments, and required quality gates.
---

# CI/CD Pipeline Conformance Review

## Intent

Ensure CI/CD pipelines enforce the repository’s operating contract: quality,
traceability, incremental execution, and immutability.

---

## When to Use

- Creating new pipelines for a component
- Modifying build/test/release/deploy pipelines
- Reviewing pipeline drift or exceptions

---

## Precondition Failure Signal

- Pipelines rebuild/retest/redeploy everything without justification
- Pipelines allow deployment from mutable refs (branches)
- Required quality checks are missing or non-blocking
- Tagging/versioning is inconsistent or absent

---

## Postcondition Success Signal

- Pipelines run the right scope based on impact
- Quality gates are enforced and reproducible
- Releases are immutable and tag-linked
- Deployments reference explicit versions/tags
- Exceptions are explicit and reviewed

---

## Process

1. **Source Review**: Audit the pipeline configuration (YAML, scripts, etc.) and compare against monorepo standards.
2. **Implementation**: Adjust the pipeline to ensure it enforces quality gates, uses tag-based deployments, and implements incremental execution.
3. **Verification**: Execute the pipeline and verify that it correctly handles both valid and invalid changes (e.g., fails on quality gate violations).
4. **Documentation**: Document any exceptions or specific pipeline behaviors that differ from the standard.
5. **Review**: Platform/DevOps Engineer and Tech Lead review the pipeline for conformance and security.

---

## Example Test / Validation

- Demonstrate a change triggers only impacted pipelines
- Demonstrate pipeline fails on quality gate violations
- Demonstrate deployment input is an immutable version/tag reference

---

## Common Red Flags / Guardrail Violations

- Making checks advisory to reduce failures
- Introducing pipeline exceptions without documentation
- Deploying from main because “it’s simpler”
- Skipping traceability mechanisms for non-prod environments

---

## Recommended Review Personas

- **Platform/DevOps Engineer** – validates pipeline behaviour and enforcement
- **Tech Lead** – validates alignment to operating contract and scope discipline
- **Security Reviewer** – validates provenance and integrity controls

---

## Skill Priority

P2 – Consistency & Governance  
(Escalate to P0 when traceability/integrity controls are affected.)

---

## Conflict Resolution Rules

- Pipelines must not weaken P0/P1 constraints for convenience
- Incremental behaviour must be grounded in impact analysis
- If requirements conflict, default to traceability and safety

---

## Conceptual Dependencies

- incremental-change-impact
- release-tagging-plan
- quality-gate-enforcement

---

## Classification

Governance  
Operational

---

## Notes

Pipelines are policy enforcement. Treat them as production code.