Automate quality gates and deployment pipelines

This skill covers CI/CD pipeline design and automation, treating it as the enforcement mechanism that catches what humans and AI agents miss on every single change. Its two guiding principles are shift left - catching problems as early in the pipeline as possible, with static analysis before tests, tests before staging, and staging before production - and faster is safer, meaning smaller batches and more frequent releases reduce risk rather than increase it. The quality gate pipeline runs lint, type check, unit tests, build, integration tests, optional end-to-end tests, a security audit, and a bundle-size check in sequence before a PR is ready for review, and no gate can be skipped: a failing lint gets fixed, not disabled, and a failing test gets the code fixed, not the test skipped. It provides concrete GitHub Actions configuration for a basic CI pipeline covering checkout, dependency install, lint, typecheck, test with coverage, build, and a security audit, database-backed integration tests using a Postgres service container with health checks and GitHub Secrets even for CI-only credentials, and end-to-end tests with Playwright and artifact upload on failure. It documents the CI-agent feedback loop: when CI fails, copy the failure output and feed it back to the agent with an instruction to fix and verify locally before pushing again, with specific patterns per failure type - lint failures auto-fixed and committed, type errors fixed at their reported location, test failures routed to a debugging skill, and build errors checked against configuration and dependencies.

Deployment strategy guidance covers PR preview deployments, feature flags to decouple deployment from release - shipping code without enabling it, rolling back by disabling a flag instead of reverting code, canary rollout percentages, and A/B testing - with an explicit flag lifecycle from creation through a cleanup date, staged rollouts from staging to production with a monitoring window and automatic rollback on errors, and a reversible rollback workflow triggered manually. Environment management distinguishes committed template files from uncommitted local environment files and CI or production secrets stored in dedicated secrets managers - CI should never hold production secrets. Automation beyond CI covers Dependabot or Renovate for scheduled dependency update PRs, a designated Build Cop role responsible for fixing or reverting a broken build rather than the person who broke it, and PR check requirements like required reviews, required status checks, branch protection against force-pushes, and auto-merge when checks pass. CI optimization is ordered by impact: cache dependencies, parallelize jobs, only run what changed via path filters, shard test suites across matrix builds, trim slow tests off the critical path, and use larger runners, targeting a pipeline under 10 minutes. It closes with a table of common rationalizations for skipping CI, all of which it rebuts, and a red-flags checklist covering missing pipelines, silenced failures, disabled tests, missing staging verification, no rollback mechanism, and secrets stored in code.

Use it when setting up a new project's CI pipeline, adding or modifying automated checks, configuring deployment pipelines, verifying that a change should trigger automated verification, or debugging CI failures.

Given a project's stack and deployment target, it produces GitHub Actions workflow configuration for quality gates, integration and end-to-end test jobs, preview and staged deployment configs, a rollback workflow, and a verification checklist confirming all gates are present and enforced.

GitHub Actions, ESLint and Prettier, tsc, Jest or Vitest, Playwright or Cypress, npm audit, Postgres service containers, Vercel or Netlify for preview deploys, Dependabot or Renovate for dependency updates, and GitHub Secrets with branch protection for security and merge gating.

Teams setting up or hardening CI/CD for a project, especially ones using AI agents in the loop where CI failures feed directly back into an automated fix-and-repush cycle, who want a consistent, unskippable quality gate before any change reaches production.