Review a GitLab CI/CD pipeline
Systematic review of an existing pipeline for correctness, speed and missing security controls.
Intermediate30 minCOMMUNITY ANALYSISGitLab CIDocker
Prompt
Review the attached .gitlab-ci.yml. Report in three parts: (1) correctness issues, (2) performance issues with estimated savings, (3) missing security controls. Then output a revised pipeline. For every change, add a row to a table with: change, reason, risk if not applied. Do not remove existing jobs without explaining the impact.
Problem
Nobody owns the pipeline, so changes are additive and build time grows unchecked.
Goal
A prioritised change list the team can apply incrementally.
Context
A GitLab repository with a single pipeline file and shared runners.
Expected Output
Three-part review plus a revised pipeline and a change table.
Steps
- Attach the pipeline and the runner configuration
- Ask for review before rewrite
- Apply performance changes first — they are low risk and build trust
- Apply security gates in audit mode before enforcing
Validation
- Run the revised pipeline on a branch
- Compare build duration
- Confirm gates fail on a deliberately broken branch
Security Considerations
- Check token scopes and protected variable usage by hand
- Pin scanner and base image versions
Lessons Learned
- Severity thresholds are usually too strict for brownfield repos
- The change table is what makes the review reviewable
Related prompts