edercnj/x-review-devops

Skill: DevOps Specialist Review

Purpose

Review code changes for DevOps best practices: Dockerfile multi-stage builds, container security hardening, CI/CD pipeline configuration, resource limits, health probe configuration, graceful shutdown implementation, and deployment manifests.

Activation Condition

Include this skill when container != "none" in the project configuration.

When to Use

• Pre-PR quality validation for infrastructure changes
• Reviewing Dockerfile and container configuration
• Checking deployment manifests
• Validating CI/CD pipeline changes

Triggers

• /x-review-devops 42 -- review PR #42 for DevOps patterns
• /x-review-devops Dockerfile -- review Dockerfile specifically
• /x-review-devops -- review all current infrastructure changes

Parameters

| Parameter | Type | Required | Default | Description | |-----------|------|----------|---------|-------------| | target | String | No | (current changes) | PR number or file paths to review |

Phase 0.1 — Load Agent Context

Resolve agent name: use --agent runtime flag if provided; otherwise default to devops-engineer (this skill's statically bound agent).

Skill(skill: "x-internal-load-agent-context", args: "--agent {resolved_agent_name}")

Adopt agent_context.persona. Follow agent_context.rules. Read all agent_context.core_knowledge paths before proceeding. If agent_context.status == "error": halt and report agent_context.message.

Canonical Technology Selection

Use the canonical selector as the single source of truth for review assets:

Skill(skill: "x-internal-select-context-packs",
      args: "--phase review --capabilities devops,security,observability,performance")

Consumption rules:

1. Read every path returned in required.
2. Read recommended only when relevant to the changed scope.
3. Do not duplicate static pack lists when the selector already covers the same asset.
4. Read optional only with explicit justification in findings.

Checklist(10 Items, Max Score: /20)

Each item scores 0 (missing), 1 (partial), or 2 (fully compliant).

Dockerfile (DEVOPS-01 to DEVOPS-04)

| # | Item | Score | |---|------|-------| | DEVOPS-01 | Multi-stage build (separate build and runtime stages) | /2 | | DEVOPS-02 | Non-root user in final stage (no running as root) | /2 | | DEVOPS-03 | Minimal base image (distroless, alpine, or slim) | /2 | | DEVOPS-04 | .dockerignore configured (excludes build artifacts, tests, docs) | /2 |

Container Security (DEVOPS-05 to DEVOPS-06)

| # | Item | Score | |---|------|-------| | DEVOPS-05 | No secrets in image layers (use runtime env vars or secrets manager) | /2 | | DEVOPS-06 | Image pinned to specific digest or version (no :latest tag) | /2 |

Deployment & Operations (DEVOPS-07 to DEVOPS-10)

| # | Item | Score | |---|------|-------| | DEVOPS-07 | Resource limits defined (CPU, memory) for container/pod | /2 | | DEVOPS-08 | Health probes configured (liveness, readiness, startup) in deployment manifest | /2 | | DEVOPS-09 | Graceful shutdown implemented (SIGTERM handling, connection draining) | /2 | | DEVOPS-10 | Environment-specific configuration externalized (no hardcoded values) | /2 |

Workflow

Step 1 -- Gather Context

Collect the review target: PR number or file paths from args. Run:

git diff --name-only HEAD~1..HEAD 2>/dev/null || git diff --name-only --cached

Step 2 -- Dispatch to DevOps Engineer Agent

Agent(
  subagent_type: "devops-engineer",
  description: "DevOps specialist review for {target}",
  prompt: "Review the code changes for DevOps best practices. Target: {target}. Run `git diff HEAD~1..HEAD` to get the diff. Resolve packs via `x-internal-select-context-packs --phase review --capabilities devops,security,observability,performance` and consume selector output: read all `required`, then only DevOps-relevant `recommended` assets. Avoid hardcoded duplicate pack lists. Apply your full DevOps checklist (Dockerfile, container security, deployment manifests, CI/CD, resource limits, health probes). Produce output in this exact format:\n\nENGINEER: DevOps\nSTORY: {target}\nSCORE: XX/20\nSTATUS: Approved | Rejected | Partial\n---\nPASSED:\n- [DEVOPS-XX] Description (2/2) | Evidence: {brief concrete observation}\nFAILED:\n- [DEVOPS-XX] Description (0/2) -- file:line -- Fix: suggestion [SEVERITY]\nPARTIAL:\n- [DEVOPS-XX] Description (1/2) -- file:line -- Improvement: suggestion [SEVERITY]"
)

Output Format

ENGINEER: DevOps
STORY: [story-id or change description]
SCORE: XX/20

STATUS: PASS | FAIL | PARTIAL

### PASSED
- [DEVOPS-XX] [Item description] | Evidence: {brief concrete observation}

### FAILED
- [DEVOPS-XX] [Item description]
  - Finding: [file:line] [issue description]
  - Fix: [remediation guidance]

### PARTIAL
- [DEVOPS-XX] [Item description]
  - Finding: [partial compliance details]

Error Handling

Convenções de erro/degradação transversais a review/audit (empty input, RULE-012 template fallback, falha de specialist, build/test override, idempotência) vivem em _shared/error-handling-review.md. As linhas abaixo são específicas desta skill.

| Scenario | Action | |----------|--------| | No Dockerfile found | Report INFO: no container configuration discovered | | No deployment manifests found | Skip DEVOPS-07, DEVOPS-08 and note N/A | | No CI/CD config found | Warn and proceed with available files |