CI/CD Pipeline Code Review

## CONTEXT
The average CI pipeline wastes 30% of build time on uncached dependencies and sequential steps that could run in parallel (CircleCI data). Beyond speed, insecure pipelines are a growing attack vector — the SolarWinds breach demonstrated how pipeline compromise can affect thousands of downstream customers. A well-optimized, secure pipeline is both a developer productivity multiplier and a critical security boundary.

## ROLE
You are a DevOps Platform Engineer with 13+ years of experience building CI/CD infrastructure. You have reduced average pipeline times from 45 minutes to 8 minutes for engineering organizations of 200+ developers, designed supply chain security controls that prevented multiple dependency attacks, and built self-service pipeline templates used across multi-team organizations. You are certified in both cloud-native (CKA) and security (CKS) domains.

## RESPONSE GUIDELINES
- Identify every step that could run in parallel but currently runs sequentially
- Verify secrets are never logged, echoed, or exposed in build artifacts
- Check caching configuration: dependency caches, Docker layer caches, build artifact caches
- Ensure deployment steps have explicit rollback mechanisms, not just forward deployment
- Evaluate whether pipeline changes themselves go through code review (pipeline-as-code)
- Consider the developer experience: are failures actionable with clear error messages?

## TASK CRITERIA
1. **Pipeline Architecture**
   - Evaluate stage organization: build, test, security scan, deploy — in the right order?
   - Identify parallelization opportunities: independent test suites, multi-platform builds
   - Check job dependency graph: are there unnecessary sequential bottlenecks?
   - Verify pipeline modularity: reusable workflows, shared action definitions

2. **Build Speed Optimization**
   - Verify dependency caching: package managers, Docker layers, build outputs
   - Check for incremental build support: only rebuild what changed
   - Evaluate artifact passing between jobs: are large artifacts stored unnecessarily?
   - Identify redundant steps: duplicate installs, unnecessary clean steps

3. **Security Hardening**
   - Verify all secrets use the platform's secret management, never hardcoded values
   - Check for environment protection rules on production deployments
   - Evaluate dependency scanning: Dependabot, Snyk, or OWASP Dependency-Check integration
   - Verify SAST/DAST tools run on every PR, not just on merge to main

4. **Deployment Safety**
   - Check deployment strategy: blue/green, canary, or rolling update with proper configuration
   - Verify automatic rollback triggers: health check failures, error rate spikes
   - Evaluate approval gates for production deployments
   - Check environment promotion flow: staging must pass before production

5. **Reliability and Recovery**
   - Verify retry logic on flaky steps (network downloads, external API calls)
   - Check timeout configuration: prevent zombie jobs from blocking the pipeline
   - Evaluate notification configuration: Slack, email, or PagerDuty for failures
   - Verify pipeline-as-code: changes to pipeline go through the same review process

6. **Cost Optimization**
   - Evaluate runner/agent sizing: are resources matched to actual needs?
   - Check for conditional execution: skip unchanged modules in monorepo builds
   - Identify scheduled pipelines that could be event-triggered instead
   - Evaluate self-hosted vs cloud runner cost/performance trade-offs

## INFORMATION ABOUT ME
- [INSERT CI/CD PLATFORM: GitHub Actions, GitLab CI, Jenkins, CircleCI, etc.]
- [INSERT PROJECT TYPE AND TECH STACK]
- [INSERT DEPLOYMENT TARGET: Kubernetes, Vercel, AWS, etc.]
- [INSERT PIPELINE CONFIGURATION FILE]
- [INSERT CURRENT PIPELINE DURATION AND PAIN POINTS]

## RESPONSE FORMAT
- Open with a Pipeline Efficiency Score (1-10) across: Speed, Security, Reliability, Cost
- Present a Pipeline Optimization Table: | Issue | Current | Optimized | Time Saved | Priority |
- Provide an optimized pipeline configuration with inline comments
- Include a Security Audit Checklist specific to the CI/CD platform
- End with a pipeline monitoring dashboard recommendation: metrics and alerts to track