Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kevin-Liu-01/Agent-Machines --skill ci-cd-best-practicesgit clone --depth 1 https://github.com/Kevin-Liu-01/Agent-MachinesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kevin-liu-01/agent-machines/ci-cd-best-practices)<a href="https://agentmods.dev/skills/kevin-liu-01/agent-machines/ci-cd-best-practices"><img src="https://agentmods.dev/badge/skills/kevin-liu-01/agent-machines/ci-cd-best-practices/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kevin-liu-01/agent-machines/ci-cd-best-practices"><img src="https://agentmods.dev/badge/skills/kevin-liu-01/agent-machines/ci-cd-best-practices.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.00842 |
| Opus 5 | $0.00032 | $0.00421 |
| Sonnet 5 | $0.00013 | $0.00168 |
| Haiku 4.5 | $0.00006 | $0.00084 |
Grade A, and why
ci-cd-best-practices scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CI/CD Best Practices
Runner placement
Choose the cheapest runner that matches the job's real bottleneck.
ubuntu-24.04
Use for I/O-bound or orchestration-heavy jobs:
- git / GitHub API orchestration
- AWS/Terraform apply jobs that do not compile code
- artifact upload/download
- release-please
- branch promotion and audit tagging
- Copybara sync jobs
- IAM preflight / policy simulation
- ECS force deploy
- link checking
- small lint/validation jobs that do not build or test significant code
- self-hosted runner provision / cleanup control jobs
blacksmith-4vcpu-ubuntu-2404
Use for compute-bound jobs:
- Docker builds
- Rust / Go / Python / TypeScript builds
- unit, integration, and end-to-end tests
- typechecking over real codebases
- static analysis that scans large codebases (for example Semgrep)
- Kind / KWOK / Chaos / stress workloads
- anything that spends real time compiling, bundling, or executing test suites
self-hosted AWS runners
Use only when GitHub-hosted runners cannot do the job:
- KVM / nested virtualization
- ARM64-native builds that must run on our own infrastructure
- privileged or hardware-specific workloads
- deploy jobs whose payload must run inside the target architecture/runtime
If the job is only provisioning or cleaning up the self-hosted runner, run
that control job on ubuntu-24.04. Only the payload belongs on self-hosted.
Docker artifact policy
PR CI
Every deployable image must be built in CI with push: false.
Rules:
- CD must never be the first place a Dockerfile runs
- do not push unreviewed application images to ECR from pull requests
- verify the exact Dockerfile, build context, and target platform the CD workflow uses
- make CI gates and CD path filters cover every file copied into that Docker build context
- if the Dockerfile depends on private ECR base images, log in only for pull
access; still keep
push: false
merge / branch CD
After merge, CD may build and publish the application image for the merged commit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 121 lines · 63 tokens per session scan A eae1795fcd22
ci-cd-best-practices is a skill published in the GitHub repository Kevin-Liu-01/Agent-Machines (29 stars, last pushed yesterday), licensed MIT. It adds 63 tokens to every session and 842 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
supply-chain-attack-recon
External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification…
CI/CD Pipeline Advanced
Expert-level CI/CD pipeline skill for test automation. Covers GitHub Actions, Jenkins, GitLab CI, Azure DevOps, parallel execution, matrix strategies, caching, artifact management, and deployment gates.
platform-engineering
Use this skill when building or operating internal developer platforms: infrastructure as code, CI/CD, container orchestration, service networking, secrets, and observability. Do not use it to define release process, promotion, rollout, or rollback policy; use release-engineering for that delivery model.
deploy-config
Guidance for setting up software delivery and deployment, including automated build and test pipelines, containers, environment settings, and infrastructure configuration.
provisioning-infrastructure
Cloud-native infrastructure knowledge reference covering Kubernetes, Helm, Kustomize, Operators, CRDs, GitOps (ArgoCD, Flux), and IaC (Terraform, Pulumi, CDK). Use when provisioning infrastructure, managing clusters, or working with GitOps workflows.
platform-skills
Use when troubleshooting, implementing, reviewing, or auditing platform infrastructure as a system — where Kubernetes, GitOps, CI/CD, and security concerns intersect. Provides structured diagnosis with blast radius, validation steps, and rollback plan for: Kubernetes, Flux CD, Argo CD, Terraform, GitHub Actions…