# Infra Deploy

> Validate, what-if/plan, deploy, and verify Azure infrastructure using Bicep, Terraform, or azd. Use when deploying a completed infrastructure phase to an environment.

- **Type:** Skill
- **Install:** `agentstack add skill-srnichols-plan-forge-infra-deploy`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [srnichols](https://agentstack.voostack.com/s/srnichols)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [srnichols](https://github.com/srnichols)
- **Source:** https://github.com/srnichols/plan-forge/tree/master/presets/azure-iac/.github/skills/infra-deploy

## Install

```sh
agentstack add skill-srnichols-plan-forge-infra-deploy
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Infrastructure Deploy Skill

## Trigger
"Deploy infrastructure" / "Deploy to staging" / "Run azd up" / "Apply Terraform"

## Steps

### 1. Pre-Flight Checks
```powershell
# Verify active subscription and context
az account show --query "{name: name, id: id}"

# Confirm the target environment
Write-Host "Deploying to: $env:AZURE_ENV_NAME"

# For Bicep: lint before anything
az bicep lint --file infra/main.bicep

# For Terraform
terraform init
terraform fmt -check -recursive
terraform validate
```

### 2. What-If / Plan

```powershell
# Bicep — what-if
az deployment group what-if \
  --resource-group $resourceGroup \
  --template-file infra/main.bicep \
  --parameters infra/main.parameters.json

# Terraform
terraform plan -out=tfplan

# azd
azd provision --preview
```

### 3. Deploy

```powershell
# Bicep
az deployment group create \
  --resource-group $resourceGroup \
  --template-file infra/main.bicep \
  --parameters infra/main.parameters.json \
  --name "deploy-$(Get-Date -Format 'yyyyMMdd-HHmm')"

# Terraform
terraform apply tfplan

# azd (full lifecycle)
azd up --no-prompt
```

### 4. Verify

```powershell
# Check deployment status
az deployment group list \
  --resource-group $resourceGroup \
  --query "[?properties.provisioningState=='Succeeded'] | [-1].name"

# Integration / smoke tests
Invoke-Pester -Path ./tests/integration -Output Detailed

# List any non-succeeded resources
az resource list \
  --resource-group $resourceGroup \
  --query "[?properties.provisioningState!='Succeeded'].{Name:name, Type:type, State:properties.provisioningState}"
```

## Safety Rules
- ALWAYS run what-if / plan before applying
- ALWAYS confirm the subscription before deploying to production
- NEVER apply to production without a preceding staging deployment
- NEVER auto-approve destructive changes (resource replacement or deletion)
- Ask before applying any plan that shows resource deletion

## Rollback

```powershell
# Bicep — list recent deployments, redeploy N-1
az deployment group list \
  --resource-group $resourceGroup \
  --query "sort_by([?properties.provisioningState=='Succeeded'], &properties.timestamp)[-2].name" \
  --output tsv

# Terraform
git revert HEAD
terraform apply

# azd
azd down --force  # deprovision, then re-up from last commit
git revert HEAD && azd up
```

## Temper Guards

| Shortcut | Why It Breaks |
|----------|--------------|
| "What-if is overkill for this change" | What-if catches destructive changes before they execute. Skipping it risks deleting production resources. |
| "Linting is too strict" | Linting rules encode best practices. Overriding them introduces drift from organizational standards. |
| "This policy doesn't apply to our subscription" | Policy exemptions need documentation. Ignoring policies creates compliance gaps that auditors will flag. |
| "I'll fix the warnings after deploy" | Post-deploy warnings become permanent. Fix them before they become the new baseline. |

## Warning Signs

- Deploy without what-if/plan output — changes applied without previewing impact first
- Linting errors dismissed without justification — linter warnings overridden without documenting why
- Policy violations ignored — Azure Policy or OPA violations not addressed before deploy
- No post-deploy verification — resources created but not validated as functional
- Secrets in IaC files — connection strings, keys, or passwords committed to templates

## Exit Proof

After completing this skill, confirm:
- [ ] Lint checks pass (`az bicep lint` / `terraform validate` / `tflint`)
- [ ] What-if/plan output reviewed — no unexpected deletes or replacements
- [ ] Deployment succeeds without errors
- [ ] Post-deploy verification passes (resource exists, responds, correct SKU/config)
- [ ] No secrets committed in IaC files
## Persistent Memory (if OpenBrain is configured)

- **Before deploying**: `search_thoughts("deploy failure", project: "", created_by: "copilot-vscode", type: "postmortem")` — load prior deployment failures, rollback patterns, and environment-specific lessons
- **After deploy succeeds/fails**: `capture_thought("Infra deploy: ", project: "", created_by: "copilot-vscode", source: "skill-infra-deploy")` — persist deployment outcome for future reference

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [srnichols](https://github.com/srnichols)
- **Source:** [srnichols/plan-forge](https://github.com/srnichols/plan-forge)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-srnichols-plan-forge-infra-deploy
- Seller: https://agentstack.voostack.com/s/srnichols
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.