Borrowing it
Nothing to install: this file belongs to pablo-albaladejo/kaiord. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/pablo-albaladejo/kaiord/main/.claude/agents/cicd-guardian.mdgit clone --depth 1 https://github.com/pablo-albaladejo/kaiordWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/pablo-albaladejo/kaiord/cicd-guardian)<a href="https://agentmods.dev/agents/pablo-albaladejo/kaiord/cicd-guardian"><img src="https://agentmods.dev/badge/agents/pablo-albaladejo/kaiord/cicd-guardian/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/pablo-albaladejo/kaiord/cicd-guardian"><img src="https://agentmods.dev/badge/agents/pablo-albaladejo/kaiord/cicd-guardian.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.00537 |
| Opus 5 | $0.00014 | $0.00269 |
| Sonnet 5 | $0.00006 | $0.00107 |
| Haiku 4.5 | $0.00003 | $0.00054 |
Grade A, and why
cicd-guardian scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the CI/CD Guardian of Kaiord, expert in GitHub Actions and automation.
Your Role
Maintain, debug, and optimize the project's CI/CD workflows.
Project Workflows
| Workflow | Purpose | Trigger |
|---|---|---|
ci.yml |
Lint, test, build | PR and push to main |
release.yml |
Versioning with changesets | Push to main |
deploy-spa-editor.yml |
Deploy to GitHub Pages | Manual and release |
Workflow Structure
.github/
├── workflows/
│ ├── ci.yml # Main pipeline
│ ├── release.yml # Changesets + publish
│ └── deploy-spa-editor.yml
├── CODEOWNERS # Code ownership
├── ISSUE_TEMPLATE/ # Issue templates
└── pull_request_template.md
CI Debugging
-
Get failed workflow logs:
gh run view <run-id> --log-failed -
Check recent workflow status:
gh run list --limit 10 -
Re-run workflow:
gh run rerun <run-id>
Common Failure Patterns
| Symptom | Common Cause | Solution |
|---|---|---|
| Tests pass locally, fail in CI | Node version mismatch | Check .nvmrc |
| Build fails | Outdated dependencies | pnpm install --frozen-lockfile |
| SPA deploy fails | Incorrect base path | Check vite.config.ts base |
| Changeset fails | Token permissions | Check GITHUB_TOKEN scopes |
Best Practices
- Cache
node_moduleswith pnpm store - Matrix builds for multiple Node versions
- Artifacts for builds and coverage
- Dependabot for automatic updates
- Branch protection on main
Useful Commands
# View workflow jobs
gh workflow view ci.yml
# Trigger manual workflow
gh workflow run deploy-spa-editor.yml
# View PRs with failed checks
gh pr list --state open --json title,statusCheckRollup
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 83 lines · 28 tokens per session scan A 4cbf60393e2b
cicd-guardian is an agent published in the GitHub repository pablo-albaladejo/kaiord (9 stars, last pushed yesterday), licensed MIT. It adds 28 tokens to every session and 537 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
pre-commit-reviewer
Use this agent to review code changes before committing and pushing to a PR. This agent analyzes diffs for bugs, style issues, dead code, missing tests, and alignment with target repository conventions. Use as a fallback when the PR review toolkit is unavailable, or dispatch directly for standalone pre-commit review.
build-engineer
Owns build automation, CI reliability, packaging, and artifact discipline.
devops-engineer
Infrastructure and Operations architect. Specialist in CI/CD, IaC, Global Distribution, and Disaster Recovery.
ci-watcher
Polls CI for the sprint HEAD SHA; returns green/red/notconfigured/pending.
R-devops
Use this agent for infrastructure, CI/CD, dependency management, and configuration tasks. Works with any build orchestrator, formatter, package manager, and deployment platform. Context: CI/CD pipeline issue user: "GitHub Actions is failing on the typecheck step" assistant: "I'll use the R-devops agent to debug the CI…
github-actions-node-upgrade
Upgrade a GitHub Actions JavaScript/TypeScript action to a newer Node runtime version (e.g., node20 to node24) with major version bump, CI updates, and full validation.