A shared pipeline reduces duplicated configuration only when callers understand the operation they request. Reusable CI/CD workflows need an explicit contract: inputs, authority, outputs and failure behavior. Sharing a file does not make callers' assumptions compatible.
Define the operation first
Describe whether the workflow builds an artifact, checks a change or deploys an environment. Avoid a vague operation that silently switches between low-trust validation and privileged release work. State required inputs and actions outside its scope.
Separate immutable references from convenient labels. If a caller supplies a branch or mutable tag, record how the workflow resolves the actual candidate. A successful run should be traceable to what it used, not only what the caller intended.
Validate the caller's inputs
List required values and accepted forms: target identifiers, artifact references and optional flags. Fail clearly when input is absent or unsupported. A permissive default may make an old caller appear compatible while changing the operation.
Do not interpolate untrusted input directly into executable shell text. Pass data through appropriate arguments or environment variables and validate the operation's allowed scope. Input handling must match the shell and provider actually used.
Keep authority visible
Document permissions and how credentials become available. A reusable build helper should not become a hidden route to production authority. Review the provider's real rules for inherited credentials, nested workflows and protected environments.
Changing a workflow revision must not silently expand target environments or approval authority. Deliberate authority changes need explicit review of affected callers. Pinning a revision establishes identity, not that its source or dependencies are safe.
Describe outputs and failure states
Name the artifact or evidence the caller can rely on after success. Distinguish a build result from a deployment result. Expose skipped checks and unavailable dependencies rather than returning ambiguous success.