/devops-deployment

name: devops-deployment
license: MIT
compatibility: "Claude Code 2.1.277+."
description: "CI/CD, containers and infrastructure as code: GitHub Actions, Docker, Kubernetes, Helm, Terraform. Use when setting up pipelines or deployments."
user-invocable: false
disable-model-invocation: false
metadata:
  owner-agent: "ci-cd-engineer"
  category: workflow-automation
  version: "1.0.0"
  author: "OrchestKit"
  complexity: "medium"
  tags: "devops, ci-cd, docker, kubernetes, terraform"
allowed-tools: "Read Glob Grep WebFetch WebSearch"
paths: [".github/workflows/**", "Dockerfile*", "docker-compose*", "**/k8s/**", "**/terraform/**"]
path_patterns: ["*.tf", "*.tfvars", "**/k8s/**", "**/helm/**", "Dockerfile*", ".github/workflows/*"]
invocation_hooks:
  - "command -v docker >/dev/null 2>&1 || echo 'Warning: docker not found — container operations will fail'"

DevOps & Deployment Skill

Comprehensive frameworks for CI/CD pipelines, containerization, deployment strategies, and infrastructure automation.

> **Note:** If `disableSkillShellExecution` is enabled (CC 2.1.91), the Docker install check won't run. Verify Docker is available for container operations: `docker --version`.

Overview

• Setting up CI/CD pipelines
• Containerizing applications
• Deploying to Kubernetes or cloud platforms
• Implementing GitOps workflows
• Managing infrastructure as code
• Planning release strategies

Pipeline Architecture

┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐
│ Code     │─>│ Build    │─>│ Test     │─>│ Deploy   │
│ Commit   │ │ Lint     │ │ Scan     │ │ Release  │
└──────────┘ └──────────┘ └──────────┘ └──────────┘
  triggers     artifacts    reports      monitoring

Key Concepts

CI/CD Pipeline Stages

1. **Lint & Type Check** - Code quality gates 2. **Unit Tests** - Test coverage with reporting 3. **Security Scan** - npm audit + Trivy vulnerability scanner 4. **Build & Push** - Docker image to container registry 5. **Deploy Staging** - Environment-gated deployment 6. **Deploy Production** - Manual approval or automated

Container Best Practices

**Multi-stage builds** minimize image size:

• Stage 1: Install production dependencies only
• Stage 2: Build application with dev dependencies
• Stage 3: Production runtime with minimal footprint

**Security hardening**:

• Non-root user (uid 1001)
• Read-only filesystem where possible
• Health checks for orchestrator integration

Kubernetes Deployment

**Essential manifests**:

• Deployment with rolling update strategy
• Service for internal routing
• Ingress for external access with TLS
• HorizontalPodAutoscaler for scaling

**Security context**:

• `runAsNonRoot: true`
• `allowPrivilegeEscalation: false`
• `readOnlyRootFilesystem: true`
• Drop all capabilities

Deployment Strategies

| Strategy | Use Case | Risk | |----------|----------|------| | **Rolling** | Default, gradual replacement | Low - automatic rollback | | **Blue-Green** | Instant switch, easy rollback | Medium - double resources | | **Canary** | Progressive traffic shift | Low - gradual exposure |

**Rolling Update** (Kubernetes default):

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 25%
    maxUnavailable: 0  # Zero downtime

Secrets Management

Use External Secrets Operator to sync from cloud providers:

• AWS Secrets Manager
• HashiCorp Vault
• Azure Key Vault
• GCP Secret Manager

---

References

Docker Patterns

**Load: `Read("references/docker-patterns.md")`**

Key topics covered:

• Multi-stage build examples with 78% size reduction
• Layer caching optimization
• Security hardening (non-root, health checks)
• Trivy vulnerability scanning
• Docker Compose development setup

OrchestKit Delta (house rules)

**Load: `Read("references/ork-delta.md")`**

Key topics covered:

• CI concurrency groups, the sub-5-minute feedback budget, path filtering
• Service-container health gating, SHA-pinned deploys, CDN invalidation order
• Kubernetes probe budget, request/limit baseline, PodDisruptionBudget floor
• External Secrets refresh interval, ArgoCD prune plus selfHeal, Terraform state locking
• Alert thresholds with dwell windows, request-id log binding, rollback rehearsal

Railway Deployment

**Load: `Read("rules/railway-deployment.md")`**

Key topics covered:

• railway.json configuration, Nixpacks builds
• Environment variable management, database provisioning
• Multi-service setups, Railway CLI workflows
• References: `references/railway-json-config.md`, `references/nixpacks-customization.md`, `references/multi-service-setup.md`

Deployment Strategies

**Load: `Read("references/deployment-strategies.md")`**

Key topics covered:

• Rolling deployment (`maxUnavailable` / `maxSurge`)
• Blue-green deployment (service-selector switch and rollback)
• Canary releases (replica-ratio traffic split)

---

Upstream coverage (do not restate)

This skill wraps third-party products. Vendor mechanics are not restated here; fetch them from the source below. Where a row says "house subset stays in X", that file keeps only OrchestKit's threshold, config or ordering decision, not the vendor tutorial.

| Topic | Fetch from | |-------|-----------| | GitHub Actions workflow syntax, matrix builds, artifact upload/download, cache mechanics | https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax (house cache-key subset stays in `rules/devops-ci-caching.md`) | | Trigger filters (`on.push.paths`, schedules, `workflow_dispatch`) | https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow | | Service containers for integration tests | https://docs.github.com/en/actions/tutorials/use-containerized-services/use-docker-service-containers | | Deployment environments and approval gates | https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments | | Protected branches and required status checks | https://docs.github.com/e