ci-cd-pipeline-reviewlisted

# CI/CD Pipeline Review A structured, evidence-based review of a project's CI/CD pipeline **mechanics and deployment safety** — not a code audit and not an application-security review. It investigates the actual pipeline configuration files across whatever platform(s) are in use, and reports one table the user can act on. ## Ground rules - **Evidence or it didn't happen.** Every row needs a concrete pointer — a pipeline YAML/config `file:line`, an actual job/step definition, a grep match, or (for anything that lives outside the repo, like branch-protection settings) an explicit note that it needs a platform/dashboard check. Never write "the pipeline looks solid," "deployment seems safe," or "build practices are standard" as a standalone claim — quote the actual step, trigger, or condition you found. - **Scope boundary — say it once, up front, and hold it for every row.** This skill reviews pipeline *mechanics and deployment safety*: does the pipeline build reproducibly, does it gate correctly, is a deployment recoverable, are credentials handled safely *within the pipeline config itself*. It does **not** review: - the security content of the application code (injection, auth, access control, headers, SSRF, etc.) — that is `cybersecurity-check`'s job; - dependency CVEs/license/staleness of the packages the app itself uses — that is `dependency-audit`'s job. The one place these overlap: secrets *handling inside the pipeline configuration* — a secr