devops-deployment

# DevOps & Deployment Skill

Comprehensive frameworks for CI/CD pipelines, containerization, deployment strategies, and infrastructure automation.

> **Note:** If `disableSkillShellExecution` is enabled (CC 2.1.91), the Docker install check won't run. Verify Docker is available for container operations: `docker --version`.

## Overview

- Setting up CI/CD pipelines
- Containerizing applications
- Deploying to Kubernetes or cloud platforms
- Implementing GitOps workflows
- Managing infrastructure as code
- Planning release strategies

## Pipeline Architecture

```
┌─────────────┐   ┌─────────────┐   ┌─────────────┐   ┌─────────────┐
│    Code     │──>│    Build    │──>│    Test     │──>│   Deploy    │
│   Commit    │   │   & Lint    │   │   & Scan    │   │  & Release  │
└─────────────┘   └─────────────┘   └─────────────┘   └─────────────┘
       │                 │                 │                 │
       v                 v                 v                 v
   Triggers         Artifacts          Reports          Monitoring
```

## Key Concepts

### CI/CD Pipeline Stages

1. **Lint & Type Check** - Code quality gates
2. **Unit Tests** - Test coverage with reporting
3. **Security Scan** - npm audit + Trivy vulnerability scanner
4. **Build & Push** - Docker image to container registry
5. **Deploy Staging** - Environment-gated deployment
6. **Deploy Production** - Manual approval or automated

### Container Best Practices

**Multi-stage builds** minimize image size:
- Stage 1: Install production dependencies only
- Stage 2: Build application with dev dependencies
- Stage 3: Production runtime with minimal footprint

**Security hardening**:
- Non-root user (uid 1001)
- Read-only filesystem where possible
- Health checks for orchestrator integration

### Kubernetes Deployment

**Essential manifests**:
- Deployment with rolling update strategy
- Service for internal routing
- Ingress for external access with TLS
- HorizontalPodAutoscaler for scaling

**Security context**:
- `runAsNonRoot: true`
- `allowPrivilegeEscalation: false`
- `readOnlyRootFilesystem: true`
- Drop all capabilities

### Deployment Strategies

| Strategy | Use Case | Risk |
|----------|----------|------|
| **Rolling** | Default, gradual replacement | Low - automatic rollback |
| **Blue-Green** | Instant switch, easy rollback | Medium - double resources |
| **Canary** | Progressive traffic shift | Low - gradual exposure |

**Rolling Update** (Kubernetes default):
```yaml
strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 25%
    maxUnavailable: 0  # Zero downtime
```

### Secrets Management

Use External Secrets Operator to sync from cloud providers:
- AWS Secrets Manager
- HashiCorp Vault
- Azure Key Vault
- GCP Secret Manager

---

## References

### Docker Patterns
**Load: `Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/docker-patterns.md")`**

Key topics covered:
- Multi-stage build examples with 78% size reduction
- Layer caching optimization
- Security hardening (non-root, health checks)
- Trivy vulnerability scanning
- Docker Compose development setup

### OrchestKit Delta (house rules)
**Load: `Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/ork-delta.md")`**

Key topics covered:
- CI concurrency groups, the sub-5-minute feedback budget, path filtering
- Service-container health gating, SHA-pinned deploys, CDN invalidation order
- Kubernetes probe budget, request/limit baseline, PodDisruptionBudget floor
- External Secrets refresh interval, ArgoCD prune plus selfHeal, Terraform state locking
- Alert thresholds with dwell windows, request-id log binding, rollback rehearsal

### Railway Deployment
**Load: `Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/rules/railway-deployment.md")`**

Key topics covered:
- railway.json configuration, Nixpacks builds
- Environment variable management, database provisioning
- Multi-service setups, Railway CLI workflows
- References: `${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/railway-json-config.md`, `${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/nixpacks-customization.md`, `${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/multi-service-setup.md`

### Deployment Strategies
**Load: `Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/deployment-strategies.md")`**

Key topics covered:
- Rolling deployment (`maxUnavailable` / `maxSurge`)
- Blue-green deployment (service-selector switch and rollback)
- Canary releases (replica-ratio traffic split)

---

## Upstream coverage (do not restate)

This skill wraps third-party products. Vendor mechanics are not restated here; fetch them from the
source below. Where a row says "house subset stays in X", that file keeps only OrchestKit's
threshold, config or ordering decision, not the vendor tutorial.

| Topic | Fetch from |
|-------|-----------|
| GitHub Actions workflow syntax, matrix builds, artifact upload/download, cache mechanics | https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax (house cache-key subset stays in `rules/devops-ci-caching.md`) |
| Trigger filters (`on.push.paths`, schedules, `workflow_dispatch`) | https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow |
| Service containers for integration tests | https://docs.github.com/en/actions/tutorials/use-containerized-services/use-docker-service-containers |
| Deployment environments and approval gates | https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments |
| Protected branches and required status checks | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches (house approval counts stay in `rules/devops-branch-protection.md`) |
| Kubernetes probe semantics and every probe field | https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-st