Devops

---
name: devops
description: "Audit deployment readiness across CI/CD, containers, monitoring, IaC, secrets, CDN, and DNS — score each area 0-100, identify critical gaps, and optionally auto-fix by chaining deploy sub-skills"
version: "2.0.0"
category: deploy
platforms:
  - CLAUDE_CODE
---

You are in AUTONOMOUS MODE. Do NOT ask questions. Do NOT pause for confirmation.
Execute every phase below in sequence, making decisions based on what you find.

============================================================
PHASE 0 — INPUT
============================================================

$ARGUMENTS may contain:
- A specific sub-area to focus on: `ci`, `docker`, `k8s`, `monitoring`, `terraform`, `secrets`, `cdn`, `dns`
- `--report-only` — produce the readiness report without generating or modifying files
- `--fix` — attempt to fix all identified gaps by chaining sub-skills
- A target environment: `aws`, `gcp`, `azure`, `fly`, `vercel`
- If no arguments, default to `--report-only`

============================================================
PHASE 1 — INFRASTRUCTURE DISCOVERY
============================================================

Scan the entire project root for existing infrastructure artifacts:

1. **CI/CD**: `.github/workflows/`, `.gitlab-ci.yml`, `Jenkinsfile`, `.circleci/`, `bitbucket-pipelines.yml`
2. **Containers**: `Dockerfile`, `docker-compose.yml`, `docker-compose.*.yml`, `.dockerignore`
3. **Kubernetes**: `k8s/`, `kubernetes/`, `helm/`, `charts/`, any `*.yaml` with `apiVersion: apps/`
4. **IaC**: `terraform/`, `*.tf`, `pulumi/`, `Pulumi.yaml`, `cdk/`, `cloudformation/`
5. **Monitoring**: `prometheus.yml`, `grafana/`, `datadog.yaml`, `.newrelic.yml`, `alertmanager.yml`
6. **Secrets**: `.env`, `.env.*`, `vault/`, `secrets/`, hardcoded API keys or tokens in source
7. **CDN**: `cdn/`, Cloudflare config (`wrangler.toml`), CloudFront references in Terraform
8. **DNS**: DNS records in Terraform, Cloudflare zone configs, Route53 references

Also detect the application stack:
- **Language**: Check `package.json`, `go.mod`, `Cargo.toml`, `requirements.txt`, `pyproject.toml`, `Gemfile`, `pubspec.yaml`, `pom.xml`, `build.gradle`
- **Framework**: Next.js, Fastify, Express, Django, Flask, FastAPI, Gin, Actix, Rails, Spring Boot, Flutter
- **Database**: Prisma schema, SQLAlchemy models, GORM, ActiveRecord, TypeORM

Store all findings in memory for scoring.

============================================================
PHASE 2 — READINESS SCORING
============================================================

Score each area on a 0-100 scale using the rubric below. Be precise — partial credit is valid (e.g., 35 or 65).

| Area | 0 | 25 | 50 | 75 | 100 |
|------|---|----|----|----|----|
| **CI/CD** | Nothing | Basic lint/test | PR checks + deploy | + caching + matrix | + security scan + preview deploys |
| **Containers** | Nothing | Dockerfile exists | + multi-stage | + compose + healthcheck | + non-root + .dockerignore + optimized layers |
| **Kubernetes** | Nothing | Basic deployment | + service + ingress | + HPA + probes | + PDB + resource limits + Helm |
| **IaC** | Nothing | Single resource | Modular structure | + remote state + envs | + cost tags + proper naming + outputs |
| **Monitoring** | Nothing | Basic logging | Metrics endpoint | + dashboards + alerts | + SLOs + distributed tracing |
| **Secrets** | Hardcoded values | .env files | Secrets manager | + rotation | + CI integration + audit trail |
| **CDN** | Nothing | Static hosting | CDN configured | + caching rules | + edge functions + invalidation |
| **DNS** | Nothing | Manual records | IaC-managed | + SSL + subdomains | + email DNS + health routing |

Calculate an overall **Deployment Readiness Score** as the weighted average:
- CI/CD: 25%
- Containers: 20%
- Monitoring: 15%
- IaC: 15%
- Secrets: 10%
- Kubernetes: 5% (0-weight if app is serverless/edge)
- CDN: 5%
- DNS: 5%

============================================================
PHASE 3 — GAP ANALYSIS
============================================================

For each area scoring below 50, generate a specific remediation plan:

1. What is missing (concrete, not vague)
2. Which sub-skill can fix it (reference: `deploy/github-actions`, `deploy/docker`, `deploy/k8s`, `deploy/monitoring`, `deploy/terraform`, `deploy/secrets`, `deploy/cdn`, `deploy/dns`)
3. Estimated effort: quick (<5 min), moderate (5-15 min), significant (15+ min)
4. Priority based on:
   - **Critical**: No CI/CD, secrets in source code, no containerization for production app
   - **High**: No monitoring, no IaC for cloud resources, no health checks
   - **Medium**: Missing caching, no preview deploys, basic Kubernetes without HPA
   - **Low**: No CDN, no email DNS, no edge functions

============================================================
PHASE 4 — REMEDIATION (if --fix)
============================================================

If `--fix` was passed, execute remediations in priority order:

1. **Critical items first** — fix secrets exposure, add basic CI/CD
2. **High items next** — add Dockerfile, monitoring, IaC
3. **Medium items** — optimize CI caching, add HPA, preview deploys
4. **Low items** — CDN, DNS, edge functions

For each remediation:
- Read the sub-skill's approach and apply it inline (do not shell out)
- After each fix, re-score that area and record the before/after delta
- Stop if cumulative changes exceed 20 new files (to avoid overwhelming a single PR)

============================================================
PHASE 5 — OUTPUT
============================================================

Generate a deployment readiness report. Print to stdout AND write to `DEPLOY_READINESS.md` in the project root.

```
## Deployment Readiness Report

**Project**: {detected project name}
**Stack**: {language} / {framework} / {database}
**Date**: {current date}
**Overall Score**: {score}/100

### Area Scores

| Area | Score | Status | Key Finding |
|------|-------|--------|-------------|
| CI/CD | XX | PASS/WARN/FAIL | {one-line summary} |
| Containers | XX | PASS/WARN/FAIL | {one-line summary} |
| Kubernetes | XX | PASS/WARN/FAIL | {one-line summary} |
| IaC | XX | PASS/WARN/FAIL | {one-line summary} |
| Monitoring | XX | PASS/WARN/FAIL | {one-line summary} |
| Secrets | XX | PASS/WARN/FAIL | {one-line summary} |
| CDN | XX | PASS/WARN/FAIL | {one-line summary} |
| DNS | XX | PASS/WARN/FAIL | {one-line summary} |

### Critical Gaps
{list of critical and high priority gaps with sub-skill references}

### Recommended Actions
{ordered list of remediations — each with sub-skill name, estimated effort, and expected score improvement}

### Changes Made (if --fix)
{list of files created/modified with before/after scores}
```

Use PASS for scores >= 75, WARN for 50-74, FAIL for < 50.


============================================================
SELF-HEALING VALIDATION (max 2 iterations)
============================================================

After completing deployment/infrastructure changes, validate:

1. Verify all generated files are syntactically valid (YAML, JSON, HCL, Dockerfile).
2. Run validation commands if available (terraform validate, docker build --check, kubectl dry-run).
3. Verify no secrets, credentials, or sensitive values are hardcoded.
4. If validation fails, diagnose and fix the specific syntax or config error.
5. Repeat up to 2 iterations.

IF STILL FAILING after 2 iterations:
- Document what failed and the exact error
- Include partial output if available

============================================================
NEXT STEPS
============================================================

After generating the report, suggest:
1. Which sub-skill to run first if gaps exist (with the exact command)
2. Whether the project is ready for production deployment
3. Any architectural concerns (e.g., no database backups, no rate limiting, no disaster recovery)


============================================================
SELF-EVOLUTION TELEMETRY
============================================================

After producing output, record execution metadata for the /evolve pipeline.

Check if a project memory directory exists:
- Look for the project path in `~/.claude/projects/`
- If found, append to `skill-telemetry.md` in that memory directory

Entry format:
```
### /devops — {{YYYY-MM-DD}}
- Outcome: {{SUCCESS | PARTIAL | FAILED}}
- Self-healed: {{yes — what was healed | no}}
- Iterations used: {{N}} / {{N max}}
- Bottleneck: {{phase that struggled or "none"}}
- Suggestion: {{one-line improvement idea for /evolve, or "none"}}
```

Only log if the memory directory exists. Skip silently if not found.
Keep entries concise — /evolve will parse these for skill improvement signals.

============================================================
DO NOT
============================================================

- Do NOT delete existing infrastructure files — only add or modify
- Do NOT commit changes — leave them staged for review
- Do NOT expose secrets in the report output
- Do NOT assume a cloud provider — detect or use $ARGUMENTS
- Do NOT generate Kubernetes manifests for projects that are clearly serverless/edge
- Do NOT modify application source code — only infrastructure files
- Do NOT install CLI tools or dependencies — work with what is available