# Deploying Infra

> Validate infrastructure changes and, after explicit confirmation, apply

- **Type:** Skill
- **Install:** `agentstack add skill-alexei-led-cc-thingz-deploying-infra`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [alexei-led](https://agentstack.voostack.com/s/alexei-led)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [alexei-led](https://github.com/alexei-led)
- **Source:** https://github.com/alexei-led/cc-thingz/tree/master/dist/claude/plugins/infra-ops/skills/deploying-infra

## Install

```sh
agentstack add skill-alexei-led-cc-thingz-deploying-infra
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Deploy Infrastructure

Validate first. Apply only after explicit confirmation. Never invent deploy paths,
release names, workspaces, namespaces, accounts, or environments.

## Scope

Use for dry-run validation, Terraform/Helm/Kustomize/Kubernetes apply after
confirmation, and rollout verification after apply.

Do not use for live troubleshooting, rollback investigation, cloud inspection,
authoring infra, pushing Docker images, triggering GitHub Actions workflows, or
applying without plan/diff evidence. Use `operating-infra` for inspection and
troubleshooting.

Dockerfiles and GitHub Actions are validate-only in this skill.

## Usage

`/deploying-infra --dry-run [environment] [scope]` validates only. `/deploying-infra --apply  [scope]` validates, asks, applies, then verifies. `/deploying-infra --background --dry-run [environment] [scope]` starts background validation.

Rules:

- Default mode is `--dry-run`.
- `--background` is valid only with `--dry-run`.
- `--apply` always stops for confirmation after showing plan/diff evidence.
- Production confirmation must include the exact environment name.
- If environment, context, namespace, workspace, chart, release, path, or account is unclear, ask one question.

## Workflow

1. Parse mode, environment, and optional scope.
2. Detect infra with `Glob`, `Grep`, and `Read` before shell commands.
3. Classify detected types: apply-capable Terraform/Helm/Kustomize/Kubernetes; validate-only Dockerfile/GitHub Actions.
4. Check required CLIs with safe version or discovery commands.
5. Read `references/validation-checklists.md` and use only detected sections.
6. Run validation and inspect source-backed policy checks.
7. For apply-capable types, show plan/diff evidence.
8. Stop on `--dry-run`; ask and apply on `--apply`.
9. Verify changed resources after apply.

Use a background or delegated validation agent only for large scans or explicit
`--background`. The agent validates only; it must not apply changes.

## Validation and evidence

Every validation claim needs exact command output, `file:line`, or a skipped-check
reason. For apply-capable types, plan/diff evidence is mandatory before confirmation.
Use the reference checklist for commands. Do not run commands with unresolved
placeholders; ask first.

Before confirmation, show:

```markdown
## Pre-flight: READY | BLOCKED

### Scope

- Environment: 
- Type: 
- Context/account/namespace/workspace: 

### Plan or Diff Evidence

- `` — 

### Resources Affected

- Create: 
- Modify: 
- Delete: 

### Risks

- 
```

If validation is blocked, stop. Do not continue to confirmation.

## Confirmation and apply

Ask before every apply with options: apply now, review plan again, cancel. For
production, require the exact environment name. Cancel on ambiguous or mismatched
confirmation.

Allowed apply patterns only:

- `terraform apply tfplan`
- `helm upgrade --install   --values `
- `kustomize build  | kubectl apply -f -`
- `kubectl apply -f `

Use only commands already matched to the repo layout. Do not write deployment logs
unless the repo already documents that convention.

If apply fails, stop with `DEPLOYMENT FAILED`. Do not rollback without separate
confirmation.

## Verification

After apply, verify the changed resources with the relevant checklist command or
repo convention. If rollout times out or health is degraded, show investigation
and rollback options, then ask what to do next.

## Output contracts

Use the matching header, then the listed fields.

```text
DRY RUN COMPLETE
Status; Environment; Types; Validation; Plan/Diff; Blockers; Skipped

AWAITING CONFIRMATION
Environment; Type; Command; Destructive changes; Confirmation needed

BACKGROUND VALIDATION STARTED
Agent ID; Mode; Scope

DEPLOYMENT COMPLETE
Environment; Type; Status; Applied; Verification; Rollback option

DEPLOYMENT BLOCKED | DEPLOYMENT FAILED
Environment; Type; Reason; Evidence; Next step
```

## Failure handling

- Unknown target detail: ask one question.
- Missing tool, missing plan/diff evidence, unshown destructive change, or blocked validation: stop.
- Apply failure or partial deployment: report exact evidence and ask before rollback.
- Rollout timeout or degraded health: show rollback and investigation options, then ask.
- User cancels or gives ambiguous confirmation: stop cleanly.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [alexei-led](https://github.com/alexei-led)
- **Source:** [alexei-led/cc-thingz](https://github.com/alexei-led/cc-thingz)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-alexei-led-cc-thingz-deploying-infra
- Seller: https://agentstack.voostack.com/s/alexei-led
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.