---
skill_id: gf-po-ci-artifact-hygiene
evaluation: free
quality: agent-decision-grade
functional: true
price_usd_full: 4.99
price_label: $4.99 / unlock
kind: good
category: Coding
challenge: https://lvlltd.com/api/pay?skill=gf-po-ci-artifact-hygiene
outline: https://lvlltd.com/skills/gf-po-ci-artifact-hygiene/outline.json
runtime_after_unlock: src/index.js createSkill
standards: x402, ERC-7857
completion_pass: functional-v1
---

# Free sample — CI Artifact Hygiene Pack

**Skill ID:** `gf-po-ci-artifact-hygiene`  
**Unlock:** $4.99 / unlock USDC on Base via x402  
**What you get after pay:** runnable sealed pack (`createSkill().run`) + workbook + templates  

## Summary

CI artifact retention, naming, SBOM-light inventory, and poison-cache prevention for agent marketplace build pipelines.

Keep CI artifacts trustworthy: naming conventions, retention TTLs, signature or hash notes, cache keys that do not leak secrets, and purge runbooks. Free outline; sealed x402 unlock. Not legal advice; no compliance certification.

## When to use

- Build caches serve stale or wrong artifacts after dependency bumps and nobody owns purge criteria.
- Artifact names collide across branches and production deploys cannot prove which commit produced the zip.
- You need a light inventory of what CI retains so sealed packs and deploy tarballs do not rot forever with secrets inside.

## Decision-grade outline (free)

1. Standardize artifact naming: product, git SHA, branch slug, and build number so every download maps to one commit.
2. Set retention and purge: TTLs by artifact class (ephemeral test, release candidate, production promote), plus manual purge owners.
3. Harden caches: key composition rules, forbidden secret paths, and when to force clean runners after dependency or lockfile changes.
4. Record integrity notes: optional checksums, who may promote an artifact, and a quarantine path for failed integrity checks.
5. Audit monthly: orphan artifacts, oversized logs, and pipeline steps that still upload debug dumps with tokens redacted poorly.

## Capabilities

- Artifact naming convention template binding SHA, branch, and build number
- Retention TTL matrix by artifact class with purge owners
- Cache key hygiene rules that avoid secret and lockfile poison cases
- Integrity and promote quarantine checklist for release candidates
- Monthly CI artifact audit agenda for orphans and oversized dumps

## Artifacts after unlock

- `ci-artifact-hygiene.md`
- `retention-ttl-matrix.csv`
- `cache-key-rules.yaml`
- `artifact-audit-checklist.md`

## Detailed description

CI is a production dependency even when it is not user-facing. Stale caches, colliding artifact names, and forever-retained zips create reliability and trust debt that shows up as “works on my branch” deploys. CI Artifact Hygiene Pack is a coding reliability good for teams shipping agent marketplaces, sealed packs, and Pages builds. Naming standards bind product, git SHA, branch slug, and build number so every download is attributable. Retention TTLs differ by class—ephemeral test outputs, release candidates, production promotes—with named owners for manual purge when something ships poison. Cache key rules forbid secret-bearing paths and force clean runners after lockfile changes so dependency bumps actually take effect. Integrity notes describe checksum recording, who may promote an artifact to production, and a quarantine path when hashes fail. A monthly audit catches orphan artifacts, oversized logs, and steps that still upload debug dumps with incomplete redaction. A free outline is on the listing; the sealed pack unlocks via x402 Base USDC. Operational and coding guidance only—not legal advice, not a SOC2 package, not a security audit certification, and no guarantees of compliance outcomes. Use it so the artifact that ships is the artifact you think you built.

## Functional runtime (paid)

After verified payment the sealed pack includes:

| Path | Role |
|------|------|
| `src/index.js` | `createSkill`, `run`, `plan`, `checklist` |
| `src/runbook.js` | Outline-driven steps with done_when |
| `src/tools.js` | Tool schemas for agent registries |
| `WORKBOOK.md` | Human/operator procedure |
| `templates/` | Checklist + artifact shells |
| `schemas/output.schema.json` | Result contract |

### Agent snippet (after unlock)

```js
import { createSkill } from "./src/index.js";
const skill = createSkill({ tenantId: "ops", agentId: "buyer" });
const result = await skill.run({
  goal: "Execute CI Artifact Hygiene Pack for my catalog",
  context: { skill_id: "gf-po-ci-artifact-hygiene" },
  dry_run: false,
});
// result.ok, result.steps, result.artifacts
```

## Pay path

1. Free: this sample + outline.json  
2. `GET https://lvlltd.com/api/pay?skill=gf-po-ci-artifact-hygiene` → HTTP 402  
3. Transfer `maxAmountRequired` USDC to `payTo` on Base  
4. `POST /api/pay` with `X-PAYMENT: {"txHash":"0x…","skill":"gf-po-ci-artifact-hygiene"}`  
5. Write `sealed_pack.files` to disk or use install-unlocked-pack.mjs  
6. Re-redeem anytime with the same verified txHash  

## Honesty

- No revenue, conversion, or uptime guarantees  
- Not legal, tax, medical, or investment advice  
- Crypto transfers are irreversible  
- Confirmed unlocks only for proof strips (/api/proof)  

*Public `/sealed/gf-po-ci-artifact-hygiene/` is teaser-only. Full `src/` is paywalled under locked sealed delivery.*