operating-infra

Name: operating-infra
Author: alexei-led

35stars5forks

How to install operating-infra?

alexei-led/cc-thingz/operating-infra

$npx -y skills add alexei-led/cc-thingz --skill operating-infra

Installs into the current project.

Summary

Work from files, plans, logs, and read-only commands before changing anything. - Do not run apply, delete, destroy, or rollback until identity, exact resources, blast radius, and plan/diff/inventory are shown and the user confirms. - If the task is deployment, rollout, rollback

Files · 1

View on GitHub

SKILL.md

1	# Operate Infrastructure
2
3	## Boundary
4
5	- Work from files, plans, logs, and read-only commands before changing anything.
6	- Do not run apply, delete, destroy, or rollback until identity, exact resources, blast radius, and plan/diff/inventory are shown and the user confirms.
7	- If the task is deployment, rollout, rollback, or production apply, use `deploying-infra`.
8	- If the task is only shell scripts, generic command pipelines, or the shell body
9	inside a GitHub Actions `run:` step, use `writing-shell`.
10	- For GitHub Actions, workflow structure, triggers, jobs, permissions, runners,
11	actions, environments, secrets, caching, concurrency, and policy stay here.
12	Mixed workflow and shell-body changes compose with `writing-shell`.
13
14	## Role behavior
15
16	- Write-capable: make minimal file changes and run safe validation. Stop before live mutation unless the user confirmed exact resources.
17	- Read-only: apply nothing; return proposed file changes, evidence, and validation commands.
18
19	## Load references
20
21	Load every matching reference:
22
23	- Terraform/OpenTofu files, modules, state, or plans → [terraform.md](references/terraform.md)
24	- Kubernetes manifests or `kustomization.yaml` → [kubernetes.md](references/kubernetes.md)
25	- `Chart.yaml`, Helm values, or chart templates → [helm.md](references/helm.md)
26	- GitHub workflow YAML outside pure `run:` shell bodies → [github-actions.md](references/github-actions.md)
27	- `Dockerfile` or container image build/release concerns → [dockerfile.md](references/dockerfile.md)
28	- AWS CLI, EC2, ECS, Lambda, S3, RDS, IAM, or CloudWatch → [aws.md](references/aws.md)
29	- GCP CLI, GCS, Compute Engine, IAM, quotas, or Cloud Logging → [gcp.md](references/gcp.md)
30	- Cloud Run services, revisions, traffic, or logs → [cloud-run.md](references/cloud-run.md)
31	- BigQuery queries, tables, datasets, or cost checks → [bigquery.md](references/bigquery.md)
32	- Linux services, hosts, processes, disks, or networks → [linux.md](references/linux.md)
33
34	Mixed stacks: load all matching references. Unknown stack: use the workflow below only.
35
36	## Workflow
37
38	1. Identify scope: files, resources, environment, account/project, region/zone, and owner.
39	2. Verify cloud identity before cloud work; prefer explicit profile/project/region over defaults.
40	3. Inspect current state with read-only evidence: files, plan/diff, list/describe/status, logs, metrics, and recent events.
41	4. For authoring/design: choose the smallest pattern that preserves ownership, state boundaries, and least privilege.
42	5. For troubleshooting: rank likely causes, gather one safe signal, then propose the next step.
43	6. For validation: run relevant gates when tools exist; state skipped gates and why.
44	7. For destructive, costly, or externally visible work: show exact resources and blast radius, then stop for confirmation or hand off to `deploying-infra`.
45
46	## Validation gates
47
48	- Terraform/OpenTofu: format, init without backend when possible, validate, plan, `tflint`, `checkov` or `trivy config`; use plan JSON for policy checks when needed.
49	- Kubernetes/Kustomize: render first, schema-check with `kubeconform`, then policy/security-check with `kube-linter`, `kubescape`, `conftest`, or `kyverno`.
50	- Helm: lint chart, render templates, use `helm diff` before upgrade planning, validate rendered YAML.
51	- Docker/images: lint Dockerfile with `hadolint`; scan images/config with `trivy`; use `syft`, `grype`, and `cosign` where SBOM, vulnerability, or signature proof matters.
52	- GitHub Actions: run `actionlint` and `zizmor`; require SHA-pinned actions and least-permission jobs.
53	- Cloud CLI: verify identity, inventory resources, estimate cost or dry-run when available, and check IAM/quota before mutation.
54
55	## Output
56
57	```text
58	INFRA RESULT
59	============
60	Scope: <files/resources/environment>
61	Identity: <account/project/profile/region or not applicable>
62	Status: DONE \| NEEDS CONF

People who liked this also viewed

6 picks

Type

operating-infra

35stars5forks

View on GitHub

How to install operating-infra?

alexei-led/cc-thingz/operating-infra

$npx -y skills add alexei-led/cc-thingz --skill operating-infra

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Operate Infrastructure
2
3	## Boundary
4
5	- Work from files, plans, logs, and read-only commands before changing anything.
6	- Do not run apply, delete, destroy, or rollback until identity, exact resources, blast radius, and plan/diff/inventory are shown and the user confirms.
7	- If the task is deployment, rollout, rollback, or production apply, use `deploying-infra`.
8	- If the task is only shell scripts, generic command pipelines, or the shell body
9	inside a GitHub Actions `run:` step, use `writing-shell`.
10	- For GitHub Actions, workflow structure, triggers, jobs, permissions, runners,
11	actions, environments, secrets, caching, concurrency, and policy stay here.
12	Mixed workflow and shell-body changes compose with `writing-shell`.
13
14	## Role behavior
15
16	- Write-capable: make minimal file changes and run safe validation. Stop before live mutation unless the user confirmed exact resources.
17	- Read-only: apply nothing; return proposed file changes, evidence, and validation commands.
18
19	## Load references
20
21	Load every matching reference:
22
23	- Terraform/OpenTofu files, modules, state, or plans → [terraform.md](references/terraform.md)
24	- Kubernetes manifests or `kustomization.yaml` → [kubernetes.md](references/kubernetes.md)
25	- `Chart.yaml`, Helm values, or chart templates → [helm.md](references/helm.md)
26	- GitHub workflow YAML outside pure `run:` shell bodies → [github-actions.md](references/github-actions.md)
27	- `Dockerfile` or container image build/release concerns → [dockerfile.md](references/dockerfile.md)
28	- AWS CLI, EC2, ECS, Lambda, S3, RDS, IAM, or CloudWatch → [aws.md](references/aws.md)
29	- GCP CLI, GCS, Compute Engine, IAM, quotas, or Cloud Logging → [gcp.md](references/gcp.md)
30	- Cloud Run services, revisions, traffic, or logs → [cloud-run.md](references/cloud-run.md)
31	- BigQuery queries, tables, datasets, or cost checks → [bigquery.md](references/bigquery.md)
32	- Linux services, hosts, processes, disks, or networks → [linux.md](references/linux.md)
33
34	Mixed stacks: load all matching references. Unknown stack: use the workflow below only.
35
36	## Workflow
37
38	1. Identify scope: files, resources, environment, account/project, region/zone, and owner.
39	2. Verify cloud identity before cloud work; prefer explicit profile/project/region over defaults.
40	3. Inspect current state with read-only evidence: files, plan/diff, list/describe/status, logs, metrics, and recent events.
41	4. For authoring/design: choose the smallest pattern that preserves ownership, state boundaries, and least privilege.
42	5. For troubleshooting: rank likely causes, gather one safe signal, then propose the next step.
43	6. For validation: run relevant gates when tools exist; state skipped gates and why.
44	7. For destructive, costly, or externally visible work: show exact resources and blast radius, then stop for confirmation or hand off to `deploying-infra`.
45
46	## Validation gates
47
48	- Terraform/OpenTofu: format, init without backend when possible, validate, plan, `tflint`, `checkov` or `trivy config`; use plan JSON for policy checks when needed.
49	- Kubernetes/Kustomize: render first, schema-check with `kubeconform`, then policy/security-check with `kube-linter`, `kubescape`, `conftest`, or `kyverno`.
50	- Helm: lint chart, render templates, use `helm diff` before upgrade planning, validate rendered YAML.
51	- Docker/images: lint Dockerfile with `hadolint`; scan images/config with `trivy`; use `syft`, `grype`, and `cosign` where SBOM, vulnerability, or signature proof matters.
52	- GitHub Actions: run `actionlint` and `zizmor`; require SHA-pinned actions and least-permission jobs.
53	- Cloud CLI: verify identity, inventory resources, estimate cost or dry-run when available, and check IAM/quota before mutation.
54
55	## Output
56
57	```text
58	INFRA RESULT
59	============
60	Scope: <files/resources/environment>
61	Identity: <account/project/profile/region or not applicable>
62	Status: DONE \| NEEDS CONF

People who liked this also viewed

6 picks

Type