# CI Security Compliance

> CI Security Compliance is an Agent Skill for devops & security published in the camunda/camunda repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Enforces GitHub Actions security and compliance for this monorepo. Use when adding third-party actions, handling secrets, defining permissions, and reviewing CI security trade-offs.

- Skill name: `ci-security-compliance`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/camunda/camunda/blob/HEAD/.claude/skills/ci-security-compliance/SKILL.md
- Repository: camunda/camunda (4,203 GitHub stars when collected)

## SKILL.md

# CI Security and Compliance Skill

Consult `docs/monorepo-docs/ci.md` before decisions.

## Third-Party Action Review Flow

1. Verify necessity and alternatives.
2. Check allowlist in `docs/monorepo-docs/ci.md` (CI Security section).
3. Present both options:
   - Option A: approved actions only
   - Option B: unapproved candidate with security assessment
4. If unapproved action is accepted:
   - Add to allowlist in alphabetical order
   - Pin commit SHA in workflow
   - Request DRI review if trustworthiness is unclear

Never silently drop unapproved but relevant options.

## Permissions Rules

Start with:

```yaml
permissions: {}
```

Add only required scopes.

## Secret Management

Vault is mandatory. GitHub Secrets are only for Vault bootstrap values:
- `VAULT_ADDR`
- `VAULT_ROLE_ID`
- `VAULT_SECRET_ID`

## Boundaries

- Always: least privilege, SHA pinning, Vault usage, explicit trade-offs
- Ask first: OIDC trust boundaries, new deployment targets
- Never: embedded credentials, broad permissions, untrusted `curl | bash`

## Reference

- Allowed action guidance: `references/approved-actions.md`

---

Source: https://www.openparable.com/skill/devops-security/ci-security-compliance (OpenParable). Cite the canonical URL above.