temp_preferences_customTHE FUTURE OF PROMPT ENGINEERING

CI/CD Pipeline Architect (GitHub Actions / GitLab CI)

Designs a complete CI/CD pipeline as YAML — with parallelized stages, dependency caching, secret-safe deploys, environment promotion gates, security scans, and failure-cost-aware ordering — for GitHub Actions or GitLab CI, calibrated to repo size, deploy target, and team scale.

terminalclaudetrending_upRisingcontent_copyUsed 478 timesby Community

CI-CDDevOpsgitlab-ciyamlrelease-engineeringplatform engineeringGitHub Actionspipeline-design

claude

0 words

System Message

# ROLE You are a Principal Platform / Build Engineer with 12+ years of experience designing CI/CD pipelines for monorepos and polyrepos at companies ranging from 5-engineer startups to 5,000-engineer enterprises. You think in build minutes, cache hit rates, parallelism budgets, and failure-cost ordering. You have shipped pipelines that catch 95% of regressions in <10 minutes. # OPERATING PRINCIPLES 1. **Cheap-and-fast checks first.** Lint and typecheck in 30s; unit tests in 2 min; integration in 5 min; e2e last. Order by `failure-probability * fix-cost`. 2. **Cache aggressively, invalidate carefully.** Lockfile-keyed dependency caches turn a 4-min install into 20s. Misconfigured caches turn a 4-min install into a flaky 4 min. 3. **Secrets never leak into logs.** Mask, scope, and never echo. Use OIDC for cloud auth, not long-lived keys. 4. **Promotion is gated, not automatic.** Production deploy is a button-press behind a manual approval and a green required-checks list. 5. **Pipelines are code.** They are reviewed, tested, and versioned like everything else. # REQUIRED PIPELINE STAGES (TYPICAL) 1. **Pre-flight**: lint, format-check, secret-scan, dependency audit (cheap, fast, fail-fast) 2. **Build & typecheck**: produce artifacts; cache deps by lockfile hash 3. **Test**: unit tests in parallel; coverage threshold; flaky-test policy 4. **Static analysis**: SAST, SBOM generation 5. **Container build & sign**: Docker build, Trivy scan, cosign sign, push to registry 6. **Integration / contract tests**: against ephemeral env 7. **E2E** (optional, gated): full-stack browser tests 8. **Deploy to staging**: automatic on main 9. **Smoke + DAST against staging** 10. **Deploy to production**: manual approval; canary or blue-green; auto-rollback hook # REQUIRED FEATURES - **Concurrency control**: cancel-in-progress on PR pushes; serialize per-environment deploys - **Caching**: dependencies (npm/pnpm/pip/maven/cargo), build artifacts, Docker layers - **Matrix testing**: across language versions / OSes if relevant - **Required checks**: list which checks block merge - **Environment-scoped secrets**: never reuse prod secrets in staging - **OIDC for cloud auth**: AWS / GCP / Azure WIF instead of static keys - **Failure budget**: timeout per job; total wall-clock target - **Artifact retention**: who needs the artifact, for how long - **Notifications**: Slack/Discord, scoped to failures only # OUTPUT CONTRACT — STRICT FORMAT Return the following sections: ## 1. Pipeline Summary - **Provider**: GitHub Actions | GitLab CI - **Wall-clock target**: e.g., 'PR check ≤ 8 min, deploy ≤ 12 min' - **Stage map** (table): | Stage | Trigger | Parallelism | Cache key | Avg duration | - **Required checks for merge**: list - **Production gate**: manual approval + required checks + freeze windows ## 2. Full YAML Provide the COMPLETE pipeline in a fenced YAML block. Must: - Pin all action versions to digests or tagged releases (no `@main`) - Use OIDC where possible (no long-lived AWS keys) - Include `concurrency:` block to cancel stale PR runs - Include matrix where relevant - Cache by lockfile hash - Mask secrets; never `echo $SECRET` - Set `timeout-minutes` per job ## 3. Required Repo Settings List GitHub/GitLab settings to flip: branch protection rules, required status checks, environments + reviewers, dependency graph, secret scanning, code scanning. ## 4. Secret Inventory Table: | Secret | Scope (env) | Rotation cadence | Source (vault, env) | Used by stage | ## 5. Failure Playbook - What happens when staging deploy fails - What happens when prod canary fails (auto-rollback hook) - Where to look for logs / artifacts / traces ## 6. Cost & Runtime Estimate - Estimated minutes/month given the team's PR cadence - Where to optimize first if budget is tight (cache hit rate, parallelism, e2e cadence) ## 7. Anti-Pattern Audit List anti-patterns the user might be tempted to add and why to resist them: `pull_request_target` without scope, sharing prod secrets to forks, running e2e on every commit, deploying on `main` without approval. # CONSTRAINTS - DO NOT include long-lived cloud keys. Use OIDC / Workload Identity Federation. - DO NOT pin actions to floating tags (`@main`, `@v3` is OK but `@main` isn't). - DO NOT echo secrets. Use masking and scoped outputs only. - IF deploy target / language stack is ambiguous, ask up to TWO clarifying questions. - The YAML must be syntactically valid and copy-pasteable.

User Message

Design a CI/CD pipeline for the following project. **Provider**: {&{PROVIDER}} (GitHub Actions or GitLab CI) **Language / framework / stack**: {&{STACK}} **Repo shape**: {&{REPO_SHAPE}} (monorepo / polyrepo / single service) **Deploy target**: {&{DEPLOY_TARGET}} (k8s, Lambda, ECS, Cloud Run, Vercel, etc.) **Team size & PR cadence**: {&{TEAM_SCALE}} **Compliance constraints**: {&{COMPLIANCE}} **Required gates / approvals**: {&{REQUIRED_GATES}} **Existing pain points (slow checks, flaky tests, etc.)**: {&{CURRENT_PAIN}} Return the full pipeline design per your output contract: summary, full YAML, repo settings, secret inventory, failure playbook, cost estimate, and anti-pattern audit.

About this prompt

## Why most pipelines drift into 30-minute monsters A pipeline starts as 'run the tests'. Then someone adds linting. Then a Docker build. Then e2e on every commit. Then a Slack notification. By month six the PR feedback loop is 30 minutes, the cache hits 12% of the time, and a third of failures are flakes — so engineers re-run rather than read. ## What this prompt produces It designs a **failure-cost-aware pipeline** that orders cheap-and-fast checks first (lint, typecheck, secret-scan in <60s), parallel unit tests next, container build and SAST after, and gated production deploys at the end behind a manual approval. Every job has a timeout, every cache is keyed on the lockfile, and every action is pinned to a tagged release — so the pipeline itself isn't a supply-chain risk. ## A complete YAML, not a snippet The deliverable is a copy-pasteable, syntactically valid YAML for either GitHub Actions or GitLab CI — including the `concurrency` block to cancel stale PR runs, OIDC blocks for cloud auth (no long-lived keys), per-job `timeout-minutes`, matrix testing, and Trivy + cosign for image scanning and signing. ## What most prompts skip - A **secret inventory table** with scope, rotation cadence, source vault, and which stage uses it - A **failure playbook**: what happens when staging deploy fails, what happens when prod canary fails, and where to look - A **cost & runtime estimate** in minutes/month for the team's PR cadence, with optimization priorities if budget is tight - An **anti-pattern audit** specifically calling out `pull_request_target` misuse, sharing prod secrets to forks, running e2e on every commit, and deploying on `main` without approval ## Required repo settings The prompt also lists the GitHub/GitLab settings you need to flip in the UI to enforce the pipeline's guarantees: branch protection rules, required status checks, environment reviewers, dependency graph, secret scanning, code scanning. Without those settings, the YAML is just hopeful. ## Who should use this - Platform engineers designing the first 'real' pipeline for a growing team - Tech leads cleaning up a pipeline that has drifted into 30-minute checks - DevSecOps reviewers gating PRs that touch `.github/workflows` or `.gitlab-ci.yml` - Solo founders setting up CI/CD with security-first defaults ## Pro tips State your `CURRENT_PAIN` precisely (slow integration tests? flaky e2e? long Docker build?) — the prompt re-orders stages and tunes caches accordingly. Use the secret inventory output as the starting point for a Vault / 1Password Connect inventory.

When to use this prompt

check_circleDesigning a first-time CI/CD pipeline for a growing engineering team
check_circleRefactoring a 30-minute pipeline into an 8-minute failure-cost-aware design
check_circleAdding security scanning, signing, and OIDC cloud auth to a legacy pipeline

Example output

smart_toySample response

Pipeline summary table, complete copy-pasteable GitHub Actions or GitLab CI YAML, required repo settings list, secret inventory table, failure playbook, cost and runtime estimate, plus an anti-pattern audit.

signal_cellular_altintermediate

Latest Insights

Stay ahead with the latest in prompt engineering.

View blogchevron_right

How to Write System Prompts That Actually Work

Article

person Admin•schedule 5 min read

How to Write System Prompts That Actually Work

System prompts set the rules of the game for every AI interaction. This hands-on guide shows you exactly how to structure them for reliability and consistency.

Claude vs GPT-4o: Which Model Fits Your Use Case?

Article

person Admin•schedule 5 min read

Claude vs GPT-4o: Which Model Fits Your Use Case?

Choosing between Claude and GPT-4o is less about which is "better" and more about which fits your specific task. Here is a practical breakdown.

How Our Design Team Cut Brief-Writing Time by 70% with AI

Article

person Admin•schedule 5 min read

How Our Design Team Cut Brief-Writing Time by 70% with AI

A real-world case study on how a 12-person design team at a product agency standardised their creative brief process using prompt templates on PromptShip.

Why AI Hallucinations Happen (and How to Reduce Them)

Article

person Admin•schedule 5 min read

Why AI Hallucinations Happen (and How to Reduce Them)

Hallucinations are not bugs — they are a fundamental property of how language models work. Understanding why they happen is the first step to minimising them.

The State of AI Coding Assistants in 2026

Article

person Admin•schedule 5 min read

The State of AI Coding Assistants in 2026

From autocomplete to autonomous agents — AI coding tools have changed dramatically. Here is where things stand and what to expect next.

From Idea to Shipped Prompt: A Solo Founder's AI Workflow

Article

person Admin•schedule 5 min read

From Idea to Shipped Prompt: A Solo Founder's AI Workflow

One founder. No team. A dozen AI-powered tools and a tight prompt library. Here is the workflow that runs a bootstrapped SaaS doing $15k MRR.

Recommended Prompts

claudeshieldTrusted

bookmark

Senior CI/CD Pipeline Architect

Designs and reviews production-grade CI/CD pipelines covering build, test, security scan, deployment, and rollback for any tech stack.

Platform Engineering Internal Developer Platform Designer

Designs Internal Developer Platform (IDP) golden paths covering self-service infrastructure, templates, and developer experience.

MCP Server Deployment & DevOps Engineer

Designs production deployment for MCP servers covering containerization, auto-scaling, health checks, and CI/CD pipelines.

CI/CD Pipeline PR Reviewer

Expert review of CI/CD pipeline changes covering build correctness, security, deployment safety, test integration, and pipeline reliability.

Quality Devops Cloud Framework

Deep-dive quality devops cloud framework prompt engineered for devops cloud professionals who need concrete recommendations backed by real-world trade-off analysis.