DevOps & Deployment Skill

Comprehensive frameworks for CI/CD pipelines, containerization, deployment strategies, and infrastructure automation.

Note: If disableSkillShellExecution is enabled (CC 2.1.91), the Docker install check won't run. Verify Docker is available for container operations: docker --version.

Overview

• Setting up CI/CD pipelines
• Containerizing applications
• Deploying to Kubernetes or cloud platforms
• Implementing GitOps workflows
• Managing infrastructure as code
• Planning release strategies

Pipeline Architecture

┌─────────────┐   ┌─────────────┐   ┌─────────────┐   ┌─────────────┐
│    Code     │──>│    Build    │──>│    Test     │──>│   Deploy    │
│   Commit    │   │   & Lint    │   │   & Scan    │   │  & Release  │
└─────────────┘   └─────────────┘   └─────────────┘   └─────────────┘
       │                 │                 │                 │
       v                 v                 v                 v
   Triggers         Artifacts          Reports          Monitoring

Key Concepts

CI/CD Pipeline Stages

1. Lint & Type Check - Code quality gates
2. Unit Tests - Test coverage with reporting
3. Security Scan - npm audit + Trivy vulnerability scanner
4. Build & Push - Docker image to container registry
5. Deploy Staging - Environment-gated deployment
6. Deploy Production - Manual approval or automated

Container Best Practices

Multi-stage builds minimize image size:

• Stage 1: Install production dependencies only
• Stage 2: Build application with dev dependencies
• Stage 3: Production runtime with minimal footprint

Security hardening:

• Non-root user (uid 1001)
• Read-only filesystem where possible
• Health checks for orchestrator integration

Kubernetes Deployment

Essential manifests:

• Deployment with rolling update strategy
• Service for internal routing
• Ingress for external access with TLS
• HorizontalPodAutoscaler for scaling

Security context:

• runAsNonRoot: true
• allowPrivilegeEscalation: false
• readOnlyRootFilesystem: true
• Drop all capabilities

Deployment Strategies

Rolling Update (Kubernetes default):

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 25%
    maxUnavailable: 0  # Zero downtime

Secrets Management

Use External Secrets Operator to sync from cloud providers:

• AWS Secrets Manager
• HashiCorp Vault
• Azure Key Vault
• GCP Secret Manager

References

Docker Patterns

Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/docker-patterns.md")

Key topics covered:

• Multi-stage build examples with 78% size reduction
• Layer caching optimization
• Security hardening (non-root, health checks)
• Trivy vulnerability scanning
• Docker Compose development setup

OrchestKit Delta (house rules)

Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/ork-delta.md")

Key topics covered:

• CI concurrency groups, the sub-5-minute feedback budget, path filtering
• Service-container health gating, SHA-pinned deploys, CDN invalidation order
• Kubernetes probe budget, request/limit baseline, PodDisruptionBudget floor
• External Secrets refresh interval, ArgoCD prune plus selfHeal, Terraform state locking
• Alert thresholds with dwell windows, request-id log binding, rollback rehearsal

Railway Deployment

Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/rules/railway-deployment.md")

Key topics covered:

• railway.json configuration, Nixpacks builds
• Environment variable management, database provisioning
• Multi-service setups, Railway CLI workflows
• References: ${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/railway-json-config.md, ${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/nixpacks-customization.md, ${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/multi-service-setup.md

Deployment Strategies

Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/deployment-strategies.md")

Key topics covered:

• Rolling deployment (maxUnavailable / maxSurge)
• Blue-green deployment (service-selector switch and rollback)
• Canary releases (replica-ratio traffic split)

Upstream coverage (do not restate)

This skill wraps third-party products. Vendor mechanics are not restated here; fetch them from the source below. Where a row says "house subset stays in X", that file keeps only OrchestKit's threshold, config or ordering decision, not the vendor tutorial.

Deployment Checklist & Templates

Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/checklists-and-templates.md") for pre/during/post-deployment checklists, Helm chart structure, template reference table, and extended thinking triggers.

Related Skills

• ork:security-patterns - Security scanning and hardening patterns for CI/CD pipelines
• ork:monitoring-observability - Prometheus, Grafana and alerting for deployed applications
• ork:database-patterns - Python/Alembic migration workflow for backend deployments
• portless (upstream) - Named .localhost URLs for multi-service local dev (portless alias api 8080)

Key Decisions

Capability Details

Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/capability-details.md") for full keyword index and problem-solution mapping across all 6 capabilities (ci-cd, docker, kubernetes, infrastructure-as-code, deployment-strategies, observability).