feat(mapt-provisioner): use mapt list-versions for RHEL AI version discovery

- Add AWS auto-discovery block in provision_rhelai.sh (same pattern as Azure)
- Update SKILL.md: list-versions covers both providers
- Bump mapt to 0.14.2 (adds aws rhel-ai list-versions)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Rishabh Kothari <rkothari@redhat.com>

Author: 2 people

CLAUDE.md

@@ -8,6 +8,7 @@ This repository contains **Claudio Skills Plugin** - a Claude Code plugin that e
 
 This plugin enables Claude Code to:
 
+- **Provision and manage cloud infrastructure** using mapt for AWS and Azure (RHEL AI VMs, spot instances, GPU workloads)
 - **Analyze GitLab CI/CD job failures** using structured scripts for pipeline debugging
 - **Orchestrate Konflux production releases** with self-contained stage-to-production workflows
 - **Troubleshoot and analyze AWS CloudWatch Logs** for application debugging and monitoring
@@ -62,9 +63,17 @@ claudio-plugin/
     │       ├── run_insights_query.sh    # Custom Insights queries
     │       ├── trace_request.sh         # Cross-service request tracing
     │       └── tail_logs.sh             # Real-time log monitoring
-    └── gitlab-branch-manager/
-        ├── SKILL.md             # GitLab branch creation and protection skill
-            └── create_and_protect_branch.sh  # Branch creation + protection
+    ├── mapt-provisioner/
+    │   ├── SKILL.md             # Cloud infrastructure provisioning skill
+    │   └── scripts/
+    │       ├── _common.sh           # Shared helpers (backend validation, creds)
+    │       ├── provision_rhelai.sh   # RHEL AI provisioning (AWS + Azure)
+    │       ├── provision_snc.sh     # OpenShift SNC provisioning (AWS only)
+    │       ├── destroy.sh           # Tear down provisioned resources
+    │       └── check_status.sh      # Query Pulumi state for stack status
+    ├── gitlab-branch-manager/
+    │   ├── SKILL.md             # GitLab branch creation and protection skill
+    │       └── create_and_protect_branch.sh  # Branch creation + protection
     └── jira-utilities/
         ├── SKILL.md             # Jira utilities skill (acli-based)
             └── scripts/
@@ -144,6 +153,11 @@ source "$SCRIPT_DIR/../common.sh"
 - Used by: konflux-release skill
 - Supports: Linux x86_64, ARM64
 
+**mapt** (`tools/mapt/install.sh`)
+- Installs mapt CLI + Pulumi + all required Pulumi provider plugins
+- Used by: mapt-provisioner skill
+- Supports: Linux x86_64, ARM64
+
 **skopeo** (`tools/skopeo/install.sh`)
 - Installs skopeo via system package manager (dnf/apt/apk)
 - Used by: konflux-release skill
@@ -363,6 +377,25 @@ When a new version is released, Renovate automatically creates a PR to update th
 - Custom fields (priority, component, team, activity-type) applied via REST PATCH
 - CVE deduplication and release-date clustering via embedded jq analysis
 
+### 6. Mapt Provisioner Skill
+
+**Purpose:** Provision and manage cloud VMs and services on AWS and Azure using mapt.
+
+**Use cases:**
+- Provision RHEL AI instances with GPU support (CUDA/ROCm)
+- Use spot instances for cost-effective testing
+- Destroy provisioned resources with state cleanup
+- Check stack status and retrieve connection details
+- List available RHEL AI versions on AWS and Azure
+
+**Key features:**
+- Natural language intent mapping (user says "spin up RHEL AI on Azure with spot", skill handles the rest)
+- Automatic RHEL AI version discovery via `mapt <aws|azure> rhel-ai list-versions`
+- Stable-over-EA version preference with hard stop on EA-only scenarios
+- Spot eviction tolerance defaults tuned for GPU testing workloads
+- Pulumi state backend enforcement to prevent orphaned resources
+- mapt + Pulumi + provider plugins auto-installed via `tools/mapt/install.sh`
+
 ## Prerequisites
 
 Each skill has its own dependencies:
@@ -395,6 +428,13 @@ Each skill has its own dependencies:
 - `JIRA_TOKEN` - API token from Atlassian account settings → Security → API tokens
 - `JIRA_EMAIL` - Your Atlassian account email
 
+**Mapt Provisioner Skill:**
+- `mapt` - Installed automatically via `tools/mapt/install.sh`
+- `MAPT_BACKEND_URL` - Pulumi state backend (s3:// or azblob://)
+- AWS targets: `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` (or `AWS_PROFILE`), `AWS_DEFAULT_REGION`
+- Azure targets: `ARM_TENANT_ID`, `ARM_SUBSCRIPTION_ID`, `ARM_CLIENT_ID`, `ARM_CLIENT_SECRET`
+- Azure blob backend: `AZURE_STORAGE_ACCOUNT`, `AZURE_STORAGE_KEY`
+
 ## Installation
 
 This plugin is configured in the marketplace at `.claude-plugin/marketplace.json` and can be loaded by Claude Code from the local `claudio-plugin` directory.
@@ -742,3 +782,5 @@ Apache License 2.0 - See LICENSE file for details.
 ## Author
 
 Claudio (v0.1.0)
+
+**Knowledge Graph:** A graphify graph exists at `graphify-out/`. Use `/graphify query "<question>"` for codebase questions — the graph is faster than reading files.

claudio-plugin/skills/mapt-provisioner/SKILL.md

@@ -23,7 +23,7 @@ Users will ask in natural language — extract the intent and map it to script f
 | "tag it X=Y" / "tags X=Y,A=B" | `--tags X=Y,A=B` |
 | "store state in s3://..." / "backend s3://..." | set `MAPT_BACKEND_URL=s3://...` |
 | "destroy it" / "tear it down" / "clean up" | `destroy.sh` |
-| "what versions are available?" / "list images" | `get_azure_rhelai_version.sh --list` |
+| "what versions are available?" / "list images" | `mapt <aws\|azure> rhel-ai list-versions --accelerator <acc>` |
 | "check status" / "is it up?" | `check_status.sh` |
 | "connect to it" / "SSH in" / "run X on it" | SSH directly using conn-details |
 
@@ -60,7 +60,6 @@ Before running any provisioning script, verify the required environment variable
 | AWS | `AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY`, or `AWS_PROFILE` |
 | Azure | `ARM_TENANT_ID`, `ARM_SUBSCRIPTION_ID`, `ARM_CLIENT_ID`, `ARM_CLIENT_SECRET` (mapt maps these to `AZURE_*` internally via `setAZIdentityEnvs()`) |
 | Azure (azblob backend) | `AZURE_STORAGE_ACCOUNT`, `AZURE_STORAGE_KEY` |
-| Azure RHELAI (version auto-discovery) | `AZURE_GALLERY_RESOURCE_GROUP` — resource group mapt uses for image lookups; required when `--version` is not passed |
 | SNC (additionally) | `PULL_SECRET_FILE` (path to file from https://console.redhat.com/openshift/create/local) |
 
 If `MAPT_BACKEND_URL` is not set, **stop and explain the orphaned-resource risk**. Do NOT proceed.
@@ -78,7 +77,7 @@ OpenShift SNC is AWS only — mapt does not support Azure for SNC.
 
 | Option | Purpose |
 |--------|---------|
-| `--version` | RHELAI version (default: 3.0.0) |
+| `--version` | RHELAI version (auto-discovered if omitted; specify manually if discovery fails) |
 | `--cpus`, `--memory` | Instance size |
 | `--gpus` | Number of GPUs |
 | `--accelerator` | GPU type: `cuda` or `rocm` (mapt default: cuda) |

claudio-plugin/skills/mapt-provisioner/scripts/_common.sh

@@ -14,7 +14,6 @@
 #   ARM_CLIENT_SECRET       - Azure credential (for Azure targets)
 #   AZURE_STORAGE_ACCOUNT        - Azure storage account name (for azblob state backend)
 #   AZURE_STORAGE_KEY            - Azure storage account key (for azblob state backend)
-#   AZURE_GALLERY_RESOURCE_GROUP - Resource group mapt uses for image lookups (for Azure version auto-discovery)
 #   PULL_SECRET_FILE             - Path to OpenShift pull secret (for SNC targets)
 
 SCRIPTS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

claudio-plugin/skills/mapt-provisioner/scripts/get_azure_rhelai_version.sh

@@ -36,7 +36,7 @@ usage() {
     echo "Options:"
     echo "  --provider              Cloud provider: aws or azure (required)"
     echo "  --project-name          Stack identifier (default: auto-generated)"
-    echo "  --version               RHELAI version (azure: auto-discovered; aws: mapt default)"
+    echo "  --version               RHELAI version (auto-discovered for both aws and azure)"
     echo "  --cpus                  Number of CPUs"
     echo "  --memory                Memory in GiB"
     echo "  --gpus                  Number of GPUs"
@@ -87,7 +87,14 @@ fi
 if [[ "$PROVIDER" == "azure" && -z "$VERSION" ]]; then
     echo "Discovering latest RHEL AI version in Azure gallery..."
     ACCEL_ARG="${ACCELERATOR:-cuda}"
-    VERSION=$("$SCRIPT_DIR/get_azure_rhelai_version.sh" --accelerator "$ACCEL_ARG")
+    VERSIONS=$(mapt azure rhel-ai list-versions --accelerator "$ACCEL_ARG")
+    if [[ -z "${VERSIONS//[[:space:]]/}" ]]; then
+        echo "ERROR: no Azure RHEL AI versions returned for accelerator '${ACCEL_ARG}'." >&2
+        exit 1
+    fi
+    # Prefer stable (non-EA); fall back to EA only if no stable exists.
+    STABLE=$(echo "$VERSIONS" | { grep -v "\-ea" || true; } | tail -1)
+    VERSION="${STABLE:-$(echo "$VERSIONS" | tail -1)}"
     echo "  Found version: $VERSION"
     if [[ "$VERSION" == *"-ea"* ]]; then
         echo "" >&2
@@ -101,6 +108,31 @@ if [[ "$PROVIDER" == "azure" && -z "$VERSION" ]]; then
     fi
 fi
 
+# For AWS, discover the latest available AMI version when not specified
+if [[ "$PROVIDER" == "aws" && -z "$VERSION" ]]; then
+    echo "Discovering latest RHEL AI version in AWS..."
+    ACCEL_ARG="${ACCELERATOR:-cuda}"
+    VERSIONS=$(mapt aws rhel-ai list-versions --accelerator "$ACCEL_ARG")
+    if [[ -z "${VERSIONS//[[:space:]]/}" ]]; then
+        echo "ERROR: no AWS RHEL AI versions returned for accelerator '${ACCEL_ARG}'." >&2
+        exit 1
+    fi
+    # Prefer stable (non-EA); fall back to EA only if no stable exists.
+    STABLE=$(echo "$VERSIONS" | { grep -v "\-ea" || true; } | tail -1)
+    VERSION="${STABLE:-$(echo "$VERSIONS" | tail -1)}"
+    echo "  Found version: $VERSION"
+    if [[ "$VERSION" == *"-ea"* ]]; then
+        echo "" >&2
+        echo "ERROR: Only Early Access (EA) versions are available for accelerator '${ACCEL_ARG}' in AWS." >&2
+        echo "  Discovered version: $VERSION" >&2
+        echo "" >&2
+        echo "  EA versions are pre-release and may cause failures. Options:" >&2
+        echo "    1. Use a different accelerator: --accelerator rocm" >&2
+        echo "    2. Proceed explicitly: --version $VERSION --accelerator $ACCEL_ARG" >&2
+        exit 1
+    fi
+fi
+
 if [[ -z "$PROJECT_NAME" ]]; then
     PROJECT_NAME=$(generate_project_name "rhelai")
 fi

claudio-plugin/skills/mapt-provisioner/scripts/provision_rhelai.sh

@@ -25,7 +25,7 @@ source "$SCRIPT_DIR/../common.sh"
 # ============================================================================
 
 # renovate: datasource=github-releases depName=redhat-developer/mapt
-MAPT_VERSION="0.14.1"
+MAPT_VERSION="0.14.2"
 
 # renovate: datasource=github-releases depName=pulumi/pulumi
 PULUMI_VERSION="3.234.0"