Design a fast, deterministic CI pipeline: stage ordering by cost, dependency/build caching keyed on the lockfile, build matrices and test sharding, required-check contracts for branch protection, and SHA-pinned third-party actions.
Installs into .claude/skills of the current project.
Are you the author of Ci Pipeline Design?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/mcorbett51090-ci-pipeline-design)
---
name: ci-pipeline-design
description: "Design a fast, deterministic CI pipeline: stage ordering by cost, dependency/build caching keyed on the lockfile, build matrices and test sharding, required-check contracts for branch protection, and SHA-pinned third-party actions."
---
# CI Pipeline Design
**Purpose:** turn a repo into a fast, trustworthy CI pipeline.
## The ordering rule
Gate cheapest-first: `format -> lint -> typecheck -> unit -> build -> integration -> e2e`. A red cheap gate must never wait on an expensive one.
## Caching
- Dependency cache keyed on the **lockfile hash** (restore, install, save).
- Build cache keyed on its **inputs**.
- A cache that is never invalidated is a correctness bug — key it on what actually changes the output.
## Parallelism & required checks
- Matrix across versions/OS; **shard** slow suites.
- A single aggregating required check fans-in the matrix so branch protection stays simple.
- Never make a **flaky** job required — quarantine it.
## Supply chain inside the pipeline
Pin third-party actions to a **SHA**, not a moving tag. Use OIDC to the cloud, never a long-lived key in a CI variable.
