---name: appbuilder-cicd-pipelinedescription: >-metadata: category: deployment-automationlicense: Apache-2.0compatibility: Requires aio CLI, Node.js 18+, and a CI/CD platform (GitHub Actions, Azure DevOps, or GitLab CI)allowed-tools: Bash(aio:*) Bash(npm:*) Bash(git:*) Read Write Edit---

App Builder CI/CD Pipeline

Set up CI/CD pipelines for Adobe App Builder projects — GitHub Actions (primary), Azure DevOps, GitLab CI. Uses OAuth S2S credentials with IMS authentication. Repository secrets only (no environment secrets).

Pattern Quick-Reference

User wants	Template
GitHub Actions deploy-to-stage	assets/deploy-stage.yml
GitHub Actions deploy-to-prod	assets/deploy-prod.yml
GitHub Actions PR tests	assets/pr-test.yml
Extract secrets from workspace	assets/fetch-secrets.sh
Azure DevOps / GitLab CI / Jenkins	references/generic-pipeline-guide.md
Secrets setup guide	references/secrets-management.md
Debugging deploy failures	references/debugging.md

Fast Path (for clear requests)

When the user says "set up CI/CD for my App Builder project" and they use GitHub, generate all 3 workflow files + secrets guide immediately:

1. Copy assets/deploy-stage.yml → .github/workflows/deploy_stage.yml
2. Copy assets/deploy-prod.yml → .github/workflows/deploy_prod.yml
3. Copy assets/pr-test.yml → .github/workflows/pr_test.yml
4. Guide secrets setup using references/secrets-management.md

If user specifies Azure DevOps, GitLab CI, or Jenkins → use references/generic-pipeline-guide.md.

Quick Reference

• Workflow location: .github/workflows/ at repository root
• Bootstrap command: aio app add ci generates starter workflow files
• Official actions: adobe/aio-cli-setup-action@3 (CLI install) + adobe/aio-apps-action@3.3.0 (build/test/deploy)
• Auth model: OAuth Server-to-Server (S2S) with IMS — the auth command in aio-apps-action is DEPRECATED (JWT). Do not use it.
• Secrets scope: Repository secrets only. App Builder does NOT support GitHub environment secrets.
• Secrets per workspace: 14 secrets with workspace suffix (_STAGE, _PROD)
• Prerequisite: Add "I/O Management API" to each workspace in Developer Console before extracting secrets
• Workspace config: Run aio app use <workspace.json> to configure .aio and .env files

Full Workflow (for ambiguous or complex requests)

1. Check existing setup: Look for .github/workflows/ (from aio app add ci or manual). Check if workflows already exist.
2. Determine CI/CD platform: GitHub Actions is default. Ask if user needs Azure DevOps, GitLab CI, or Jenkins.
3. Generate workflow files: Copy templates from assets/ to .github/workflows/. Customize triggers, branch names, and environment suffixes as needed.
4. **Guide secrets setup:**a. Ensure "I/O Management API" is added to the workspace in Developer Consoleb. Download workspace.json from Developer Consolec. Run aio app use <workspace.json> to configure local .aio and .envd. Run assets/fetch-secrets.sh to extract credential valuese. Guide user to add each secret to GitHub repository secrets (NOT environment secrets)f. Add _STAGE or _PROD suffix to each secret name
5. Add custom secrets: If the app uses custom env vars, add them under the env key in the Deploy step
6. Validate: Run through references/checklist.md before merge
7. Troubleshoot: If deploy fails, consult references/debugging.md for common scenarios
8. Test: Push to a branch and verify workflow runs successfully

Inputs To Request

• Current repository path and CI/CD platform preference
• Target Adobe organization, project, and workspace names
• Whether Stage, Production, or both workspaces need CI/CD
• Any custom secrets the application requires

Deliverables

• Workflow YAML files in .github/workflows/
• Secrets extraction output for repository configuration
• Pre-merge validation against references/checklist.md

Quality Bar

• All workflow YAML must be syntactically valid
• Secrets must use repository scope, never environment scope
• OAuth S2S credentials only — no JWT auth references
• Each workspace gets its own secret set with correct suffix
• Workflows must use pinned action versions (@3, @3.3.0)

References

• Use references/github-actions-guide.md for GitHub Actions workflow patterns and secrets table.
• Use references/generic-pipeline-guide.md for Azure DevOps, GitLab CI, and Jenkins patterns.
• Use references/secrets-management.md for OAuth S2S credential extraction and GitHub secrets setup.
• Use references/debugging.md for troubleshooting deploy failures, CI errors, and workspace promotion issues.
• Use references/checklist.md for pre-merge CI readiness validation.
• Use assets/deploy-stage.yml, assets/deploy-prod.yml, assets/pr-test.yml as workflow templates.
• Use assets/fetch-secrets.sh to extract secret values from workspace configuration.
• Official Adobe docs: https://developer.adobe.com/app-builder/docs/guides/app_builder_guides/deployment/cicd-using-github-actions

Common Issues

• Workflow not triggering: Verify workflow files are committed to the default branch and triggers match your branching strategy.
• Deploy fails with auth error: The auth command is deprecated. Ensure you are using OAuth S2S credentials, not JWT. Verify all 14 secrets are set correctly with the right workspace suffix.
• "I/O Management API not found": Add the I/O Management API service to the workspace in Developer Console before extracting secrets.
• Environment secrets not working: App Builder does NOT support GitHub environment secrets. Move all secrets to repository-level secrets.
• Missing secrets: Run fetch-secrets.sh and compare output against the 14-secret table in references/github-actions-guide.md. Each value must be present and correctly suffixed.
• Custom env vars not available in action: Add custom secrets under the env key in the Deploy step of the workflow, not just in GitHub secrets.

Chaining

• Chains FROM appbuilder-action-scaffolder (after actions are implemented)
• Chains FROM appbuilder-testing (automated test execution in CI)
• Standalone after setup (workflows run automatically on push/PR/release)