Infrastructure Patterns

Role-gated action

Detect your capability from your tools, not from prose:

• Write-capable role (engineer): run the read-only dry-run, present the diff, get confirmation, then apply and verify.
• Read-only role (reviewer): a reviewer has no Bash — it cannot run terraform plan or kubectl diff. Review the manifests/modules in scope from the files and caller-supplied plan output, and emit changes in the Proposed Changes contract under Output. Apply nothing.

Detect the infra tool and load references

Detect the tool from the files in scope and load the matching reference:

• *.tf / *.tfvars → TERRAFORM.md
• K8s manifests / kustomization.yaml → KUBERNETES.md
• Chart.yaml / templates/*.yaml → HELM.md
• workflow YAML under .github/workflows/ → GITHUB-ACTIONS.md
• Dockerfile → DOCKERFILE.md
• Makefile → MAKEFILE.md