devops-deployment
Interactive browser-based AppSec training game where players identify vulnerabilities in code and learn secure coding practices
- Category: discovered
- Tags: github, community
- Version: 1.0.0
- Author: walid
- Downloads: 0
- GitHub stars: 2
- Updated: 2025-11-21
Download the latest version (v1.0.0) from this page.
SKILL.md
# DevOps & Deployment Skill
## Activation Context
Activates when working on CI/CD, deployments, infrastructure, or DevSecOps automation.
## When to Invoke devsecopsengineer Agent
- Setting up CI/CD pipelines
- Configuring deployments
- Managing infrastructure
- Implementing security automation
- Monitoring and observability
- Performance optimization
- Containerization
- Cloud infrastructure
## Responsibilities
### CI/CD Pipeline Management
- GitHub Actions workflows
- Automated testing integration
- Build automation
- Deployment automation
- Security scanning in pipeline
- Environment management
### Infrastructure
- Container orchestration (Docker, Kubernetes)
- Cloud platform configuration (AWS, GCP, Azure)
- Infrastructure as Code (Terraform, Pulumi)
- Networking and load balancing
- Database infrastructure
- Caching layers (Redis, etc.)
### Security Automation
- Automated security scanning
- Dependency vulnerability checks
- Secret management
- Container image scanning
- Infrastructure security
### Monitoring & Observability
- Application monitoring
- Infrastructure monitoring
- Log aggregation
- Alerting
- Performance metrics
- Error tracking
## Coordination Protocol
### Before Deployment
1. **From backend-engineer**: Application requirements and dependencies
2. **From database-engineer**: Database migration plans
3. **From frontend-engineer**: Build configuration and assets
4. **From security-engineer**: Security requirements and compliance
5. **From qa-engineer**: Test results and approval
### Deployment Checklist
- [ ] All tests passing in CI/CD
- [ ] Security scans clean
- [ ] Database migrations tested
- [ ] Environment variables configured
- [ ] Rollback plan prepared
- [ ] Monitoring/alerting configured
- [ ] Performance benchmarks met
- [ ] Documentation updated
### Environment Strategy
```
Development → Staging → Production
↓ ↓ ↓
Auto Auto Manual
Deploy Deploy Approval
```
## CI/CD Pipeline Structure
### Build Stage
- Install dependencies
- Run linters
- Compile/transpile code
- Run unit tests
- Generate test coverage
### Test Stage
- Run integration tests
- Run E2E tests
- Performance tests
- Security scans
### Security Stage (with security-engineer)
- SAST (Static Application Security Testing)
- Dependency scanning
- Container scanning
- Secret detection
- License compliance
### Deploy Stage
- Build artifacts/containers
- Push to registry
- Deploy to environment
- Run smoke tests
- Health checks
## Infrastructure as Code
### Best Practices
- Version control all infrastructure code
- Use modules/reusable components
- Document infrastructure decisions
- Test infrastructure changes
- Implement proper access controls
- Tag all resources appropriately
### Tools
- **Terraform/Pulumi**: Infrastructure provisioning
- **Docker**: Containerization
- **Kubernetes**: Container orchestration
- **Ansible**: Configuration management
- **GitHub Actions**: CI/CD automation
## Monitoring & Alerting
### What to Monitor
- **Application Metrics**:
- Request rate, latency, error rate
- Active users
- Business metrics
- **Infrastructure Metrics**:
- CPU, memory, disk usage
- Network traffic
- Database connections
- Queue lengths
- **Security Metrics** (with security-engineer):
- Failed login attempts
- Unusual access patterns
- Rate limiting triggers
### Alert Levels
- **Critical**: Immediate action required (page on-call)
- **High**: Action needed within hours
- **Medium**: Action needed within day
- **Low**: Informational
## Deployment Strategies
### Blue-Green Deployment
- Maintain two production environments
- Switch traffic between them
- Easy rollback
### Canary Deployment
- Deploy to small subset of users first
- Monitor for issues
- Gradually increase traffic
- Rollback if issues detected
### Rolling Deployment
- Update instances gradually
- Maintain service availability
- Rollback if issues detected
## Rollback Procedures
### When to Rollback
- Critical bugs in production
- Security vulnerabilities
- Performance degradation
- Failed health checks
### Rollback Process
1. Identify the issue
2. Notify team
3. Execute rollback (should be automated)
4. Verify rollback successful
5. Post-mortem to prevent recurrence
## Handoff Points
- **From all engineers**: Code and configuration for deployment
- **To qa-engineer**: Deployed environments for testing
- **To security-engineer**: Infrastructure security review
- **To project-manager**: Deployment status and timeline
## Security Considerations (with security-engineer)
### Secrets Management
- Use vault/secrets manager (AWS Secrets Manager, HashiCorp Vault)
- Never commit secrets to code
- Rotate secrets regularly
- Limit access to secrets
### Network Security
- Use VPCs and security groups
- Implement least privilege access
- Enable encryption in transit
- Configure firewalls properly
### Compliance
- Log all deployments
- Maintain audit trails
- Implement backup strategies
- Disaster recovery plan
## Performance Optimization
### Application Performance
- Enable caching (CDN, Redis)
- Optimize database queries (with database-engineer)
- Implement load balancing
- Use connection pooling
- Enable compression
### Infrastructure Performance
- Auto-scaling configuration
- Resource allocation optimization
- CDN for static assets
- Database read replicas
## Best Practices
- Automate everything possible
- Immutable infrastructure
- Treat logs as streams
- Build once, deploy many times
- Monitor everything
- Plan for failure
- Document runbooks
- Practice disaster recovery