cicd-pipeline-hardeninglisted

# cicd-pipeline-hardening A CI/CD pipeline runs your code *and* has credentials to your infrastructure — it's both a productivity tool and one of the highest-value attack surfaces you own. This skill builds one that is fast (cached, parallel, fails early), reproducible (pinned, hermetic), and hard to abuse (least-privilege, pinned third-party actions, provenance on artifacts). ## Use when - Setting up CI for a new repo. - Builds are slow, flaky, or wildly non-reproducible. - A security review flagged the pipeline (over-privileged tokens, unpinned actions, secrets in logs). ## Stage ordering — fail cheap, fail first Order stages by cost so the pipeline fails on the cheapest signal: 1. **Lint + format check** (seconds) — reject style/obvious errors before spending compute. 2. **Typecheck** (fast) — catch contract breaks. 3. **Unit tests** (fast, parallelizable). 4. **Build** — produce the artifact once; later stages reuse it, never rebuild. 5. **Integration/e2e tests** (slow) — only after the fast gates are green. 6. **Security scans** (SAST, dependency audit, secret scan) — can run in parallel with tests. 7. **Publish/deploy** — only on the default branch, only after everything above passes. Run independent stages in parallel; make expensive stages depend on cheap ones passing. A PR that fails lint should never reach e2e. ## Reproducibility - **Pin everything.** Lockfiles committed and `--frozen`/`ci` installs (`npm ci`, `pip install --require-hashes`, etc.). Pin the runn