# Complete Infra

> Complete infrastructure task — lint, validate, review, and submit PR. Use when an infrastructure-only branch is ready for submission — runs Terraform/Helm validation and creates the PR, skipping application/frontend checks.

- **Type:** Skill
- **Install:** `agentstack add skill-makigjuro-cloudstack-ai-plugins-complete-infra`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [makigjuro](https://agentstack.voostack.com/s/makigjuro)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [makigjuro](https://github.com/makigjuro)
- **Source:** https://github.com/makigjuro/cloudstack-ai-plugins/tree/main/plugins/cloud-infra/skills/complete-infra
- **Website:** https://github.com/makigjuro/cloudstack-ai-plugins#quick-start

## Install

```sh
agentstack add skill-makigjuro-cloudstack-ai-plugins-complete-infra
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Complete Infrastructure Task

Finalize an infrastructure branch by running infra-specific quality gates and creating a PR. This is the infra equivalent of a full completion workflow — it skips application build/tests and frontend lint.

## Prerequisites

- You must be on a feature branch (not main)
- All infrastructure changes should be committed
- Working tree should be clean

## Arguments

- `{issue}` — GitHub issue number (optional). If not provided, extract from branch name.

## Configuration

Read `cloudstack.json` from the project root at the start of execution. Extract:
- `CHARTS_PATH` = `infrastructure.chartsPath` (default: `deploy/charts`)
- `TF_PATH` = `infrastructure.terraformPath` (default: `infra/terraform/modules`)
- `TG_PATH` = `infrastructure.terragruntPath` (default: `infra/terragrunt`)
- `IAC_WRAPPER` = `infrastructure.iacWrapper` (default: `none`)

If `cloudstack.json` does not exist, auto-detect by scanning the project structure. Derive `TF_PARENT` as the parent directory of `TF_PATH`.

## Scripts

Reusable bash scripts live in `scripts/` relative to this skill directory:

| Script | Purpose |
|--------|---------|
| `scripts/validate-terraform.sh` | Validate changed Terraform modules |
| `scripts/lint-helm.sh` | Lint changed Helm charts |

These scripts read `TF_PATH` and `CHARTS_PATH` from environment variables. Export them before calling:
```bash
export TF_PATH="..." CHARTS_PATH="..."
```

The security scan (Track D below) reuses the script from the `trivy-scan` skill rather than duplicating it:
```bash
bash {plugin-skills-path}/trivy-scan/scripts/scan-trivy.sh
```

## Process

### Phase 0: Pre-flight

Run pre-flight checks inline (or source the shared preflight script if available):

```bash
BRANCH=$(git branch --show-current)
if [ "$BRANCH" = "main" ] || [ "$BRANCH" = "master" ]; then
  echo "ERROR: Cannot complete task on main branch"
  exit 1
fi
if [ -n "$(git status --porcelain)" ]; then
  echo "ERROR: Working tree is dirty. Commit or stash changes first."
  exit 1
fi
ISSUE=$(echo "$BRANCH" | grep -oE '/[0-9]+' | tr -d '/' || true)
echo "Branch: $BRANCH"
echo "Issue:  ${ISSUE:-}"
```

### Phase 1: Parallel Infrastructure Lint

Launch all lint tracks in parallel using separate Bash tool calls in a single response.

**Track A: Terraform format check**
```bash
terraform fmt -check -recursive {TF_PARENT}
```

**Track B: Terraform validate (changed modules only)**
```bash
export TF_PATH="{TF_PATH}"
bash {plugin-skills-path}/complete-infra/scripts/validate-terraform.sh
```

**Track C: Helm lint (if charts changed)**
```bash
export CHARTS_PATH="{CHARTS_PATH}"
bash {plugin-skills-path}/complete-infra/scripts/lint-helm.sh
```

**Track D: Security scan (trivy)**
```bash
export TF_PARENT="{TF_PARENT}" CHARTS_PATH="{CHARTS_PATH}"
bash {plugin-skills-path}/trivy-scan/scripts/scan-trivy.sh
```

Honours `.trivyignore` at `{TF_PARENT}/.trivyignore`. Every suppression must carry a justifying comment — see the `trivy-scan` skill for conventions.

If any lint or scan track fails, STOP and report. Treat `trivy` missing as a FAIL and print the install hint so the user can remediate.

### Phase 2: Infrastructure Review (Parallel Agents)

Launch the review agent with worktree isolation:

**Agent: `infra-reviewer`** (isolation: worktree) — Dedicated Terraform/Helm/CI review using the `infra-reviewer` agent definition. Reviews `git diff origin/main...HEAD -- {TF_PARENT}/ {CHARTS_PATH}/ .github/workflows/` and returns PASS/FAIL with findings covering security, naming, resource limits, and CI best practices.

### Phase 3: Evaluate

**If review passes:** Proceed to Phase 4.

**If issues found:**
1. Display findings
2. Fix issues (max 3 iterations)
3. Re-run from Phase 1

### Phase 4: Create PR

Run `/create-pr {issue}`.

## Output

```
## Infrastructure Task Completed

- Branch: {branch}
- Issue: #{issue}
- PR: {pr-url}

### Quality Gates
- Terraform Format: PASS
- Terraform Validate: PASS
- Helm Lint: PASS / SKIP (no chart changes)
- Security Scan (trivy): PASS / WARN (findings in .trivyignore only) / FAIL
- Infra Review: PASS

PR is ready for human review.
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [makigjuro](https://github.com/makigjuro)
- **Source:** [makigjuro/cloudstack-ai-plugins](https://github.com/makigjuro/cloudstack-ai-plugins)
- **License:** MIT
- **Homepage:** https://github.com/makigjuro/cloudstack-ai-plugins#quick-start

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-makigjuro-cloudstack-ai-plugins-complete-infra
- Seller: https://agentstack.voostack.com/s/makigjuro
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.