cicd-infra.md

CI/CD, containers, and infrastructure-as-code (router)

Routes pipelines, container images, and IaC (Terraform, Pulumi, CloudFormation, Helm values, …) to norms and skills below.

Read first (norms)

• security.md — No secrets or long-lived credentials in YAML, Dockerfiles, or .tf files; OIDC and secret stores; least privilege for deploy roles.
• pr-review.md — Keep pipeline, image, and IaC changes reviewable (scope, rollback, how to verify).
• testing.md — What must stay green before merge; contract/integration tests for infra-sensitive paths when applicable.
• observability.md — Deploy and runtime health, rollback, and knowing when a change broke production.

Procedures (skills)

• ci-workflow-change — Adding or changing CI workflow definitions (GitHub Actions, GitLab CI, etc.).
• infra-as-code-change — Terraform / Pulumi / CloudFormation-style changes with plan, state, and blast-radius discipline.
• container-image-hardening — Dockerfiles, base images, non-root users, layers, and supply-chain hygiene.
• get-ci-green — When CI is already failing after infra or pipeline edits.

Related (stack-specific)

• default-stack.md — Team-agreed runtime and cloud defaults.
• aws-service-minimum-viable — When the change includes AWS services, not only generic IaC.