ci-cd_skill

Overview

This skill is a CI/CD Pipeline Security Expert focused on desktop application builds. It provides practical patterns for secret management, code signing, artifact protection, and supply chain defenses to reduce risk across multi-platform release pipelines. The guidance emphasizes least-privilege, reproducibility, and test-driven pipeline changes.

How this skill works

I inspect and harden GitHub Actions workflows, enforcing explicit permissions, SHA-pinned actions, environment protections, and OIDC where possible. I prescribe concrete steps for secure secret handling, Windows/macOS code signing, SBOM generation, dependency scanning, and workflow testing to prevent supply chain and credential exposure. I also recommend performance patterns like caching and parallelization while preserving security gates.

When to use it

• Setting up or auditing CI/CD for desktop apps (Windows, macOS, Linux)
• Implementing code signing and notarization in automated builds
• Hardening pipelines against supply chain and dependency attacks
• Introducing secrets, OIDC, or environment-protected deploys
• Creating or validating workflow tests and security gates

Best practices

• Always set explicit permissions for GITHUB_TOKEN and avoid write-all scopes
• Pin third-party actions and tools by SHA to prevent supply chain drift
• Use environment-level secrets and approvals for production deploys
• Adopt OIDC for keyless cloud auth; rotate and scope secrets narrowly
• Generate SBOMs and sign artifacts to provide verifiable provenance
• Write failing pipeline tests first and validate workflows in PRs

Example use cases

• Build, sign, and notarize a Tauri desktop app for Windows and macOS using environment-scoped secrets
• Add dependency and SAST scanning to PRs, failing merges on high-severity findings
• Replace long-lived cloud keys with OIDC-based short-lived role assumption for deployments
• Implement SHA-pinned actions and automated SBOM generation before artifact publication
• Create workflow tests that reject unpinned actions, missing permissions, or echoed secrets