devops

Make cron jobs run when they should: a bundled script validates every crontab line, explains each schedule in plain words with its next runs, and flags missing output redirection, unescaped percent signs, PATH assumptions, day-of-month plus day-of-week confusion, DST-sensitive hours, overlaps and duplicates; then the entries are fixed with locking and logging. Use when a cron job did not run, ran twice or at the wrong time, to check or "review my crontab", or to write a new cron schedule. Not for Kubernetes CronJobs beyond the schedule field, or for systemd timers.

Harden a container image before it ships: a bundled script flags a Dockerfile that runs as root, uses unpinned or latest base images, puts secrets in ENV or ARG, pipes remote scripts to a shell, leaves apt layers unclean, makes files world-writable or has no HEALTHCHECK, and the file is rewritten as a smaller, pinned, non-root multi-stage build. Use when asked to "review my Dockerfile", to check an image is safe to publish, or to harden, slim down or write a Dockerfile for a Python or Node app. Not for Kubernetes manifests (use k8s-manifest-review) or docker-compose networking.

Compare the keys of .env.example against real .env files with a bundled script, listing missing, extra, empty and duplicate keys without ever printing a value. Use when asked "which env vars am I missing?", when a service fails on a missing variable, when onboarding, before deploying to a new environment, or to keep .env.example in sync in CI. Not for comparing values, and not a secret manager.

Write or review GitHub Actions workflows with least-privilege permissions, SHA-pinned actions, timeouts, concurrency and caching, and validate them with a bundled linter that catches missing permissions, pull_request_target checkout of fork code, expression injection in run steps, unpinned actions and literal secrets. Use when asked to "write a CI workflow", to create a release workflow, review .github/workflows, or fix a workflow security finding. Not for other CI systems and not for GitHub Apps or branch protection settings.

Review Kubernetes manifests (Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, Pods, Services, Secrets) with a bundled script for missing resource limits and probes, privileged or root containers, mutable image tags, host namespaces and hostPath mounts, inline secrets and missing seccomp, then produce the corrected YAML. Use when asked to "review this Kubernetes YAML", to harden or write manifests, or for a Helm chart's rendered output. Not for cluster-level policy (RBAC, NetworkPolicy design, admission controllers) beyond noting what the workload needs.

Generate release notes from a git commit range with a bundled script that groups commits by Conventional Commits type (breaking, features, fixes, performance, docs, build), links commits and issues, and lists contributors; then edit them into notes a user can read. Use when asked to "write the release notes", when cutting a release, writing a GitHub release body, or updating CHANGELOG.md from history. Not for deciding the version number (use semver-advisor) and not for commit message writing.

Decide the next version number (major, minor or patch, or a pre-release) for a library, service, API, CLI or schema from the actual changes, using a decision table for what counts as breaking in each kind of artefact, and explain the decision with evidence. Use when asked "is this a breaking change?", what version to release, or how to version an API or a database schema. Not for generating release notes (use release-notes).

Decide whether a saved Terraform plan may be applied under the team's written rules: a bundled script checks the plan JSON against a small YAML policy (forbidden destroys by type, required tags, a replacement ceiling, protected names, allowed providers) and prints allow, ask or block with a reason per resource. Use when asked "can we apply this plan?", before an apply in CI or a hook, or when a plan shows deletes. Not for reviewing Terraform code (terraform-review) and not for writing the change record.

Review Terraform or OpenTofu code against a fixed checklist: state and backend safety, provider and module version pinning, variables with types and validation, secrets handling, public exposure (open security groups, public buckets, 0.0.0.0/0), encryption and logging defaults, lifecycle and destroy protection, and plan hygiene. Use when asked to "review this Terraform" or other infrastructure code, a plan, or a module before apply. Not for writing cloud architecture from scratch and not a replacement for a policy engine (it tells you which rules to encode).