Skip to content
Documentation

General DevOps: Pipelines, Containers, IaC, Rollouts

FieldValue
TypeSkill Resource
Source~/.copilot/skills/platform/references/devops.md
DescriptionNot specified

Source Content

General DevOps: Pipelines, Containers, IaC, Rollouts

“It works on my machine” becomes a versioned, observable, reversible production deployment. Pipelines are products; infrastructure is code; rollouts are designed, not improvised. This reference covers the ground references/github-actions.md, references/helm/, and references/kubernetes-operator.md don’t own more specifically — Terraform, Dockerfiles, and picking a rollout strategy.

Contents

Use me for / Don’t use me for

Use for setting up CI/CD end to end, authoring Terraform modules, containerizing apps, and choosing a rollout strategy.

Don’t use for: GitHub Actions workflow architecture specifically (references/github-actions.md), custom controllers/operators (references/kubernetes-operator.md), SLI/SLO design (references/observability.md), or active incident response (references/incident-command.md).

Pipeline shape

Build → test → scan → sign → publish → deploy. Every stage idempotent, cacheable, observable. See references/github-actions.md for the GitHub-specific implementation of this shape.

Infrastructure as code

  • Terraform modules with remote state, locked providers, no console drift.
  • PR-reviewed like application code — a terraform plan in the diff, not just the .tf file.
  • Every cloud resource that outlives a sprint is IaC — nothing hand-clicked in a console survives a sprint.
  • Secrets come from a manager (1Password Connect / AWS Secrets Manager / GCP Secret Manager), never from env files in git, even encrypted, without a documented rotation policy.

Containers

  • Distroless or minimal base image, non-root user.
  • Pinned digests — never :latest, never a floating tag.
  • Multi-stage build; no secrets baked into any layer.
  • .dockerignore keeps build context small and secrets out.

Deployment strategies

StrategyDefault use
RollingDefault for stateless services.
CanaryHigh-risk changes — automated rollback on SLI/error-budget burn (pairs with references/observability.md).
Blue/greenStateful services with a data-migration plan; cut over only after the migration is verified.

Dev / staging / prod stay in the same shape — differences live in variables, never in drift.

Self-rubric

  • Rollback path is defined and tested, not assumed.
  • Secrets come from a manager, never from env files in git.
  • Observability wired before the first prod traffic (see references/observability.md).
  • State is remote, locked, and backed up (Terraform, DB, queues).
  • No :latest, no unpinned images, no manual kubectl apply in prod.
  • Runbook exists and lists the top 3 failure modes.

References