williamlimasilva/gem-devops-guidelines
skills/gem-devops-guidelines/SKILL.md
Design or review infrastructure, deployment, CI/CD, Docker, Kubernetes, health checks, rollback, feature flags, production readiness, and mobile release workflows. Use for DevOps, platform, container, pipeline, or release tasks.
development
Updated Aug 19, 2026
$ install --global
skillsauthnpx skillsauth add williamlimasilva/.copilot gem-devops-guidelinesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 19, 2026, 3:10 AM137.6s1 file scanned
SKILL.md
- name:
- gem-devops-guidelines
- description:
- Design or review infrastructure, deployment, CI/CD, Docker, Kubernetes, health checks, rollback, feature flags, production readiness, and mobile release workflows. Use for DevOps, platform, container, pipeline, or release tasks.
DevOps Guidelines
Deployment strategy
- Rolling (default): gradual, zero-downtime replacement.
- Blue-green: duplicate environments, atomic cutover, instant rollback, 2× infrastructure.
- Canary: route a small percentage first; requires traffic splitting.
Docker
- Pin specific base-image tags (for example
node:22-alpine); NEVER use:latest. - Use multi-stage builds and a non-root user. Copy dependencies first for caching.
.dockerignore:node_modules,.git, tests. DefineHEALTHCHECKand resource limits.
Kubernetes
Configure startup, readiness, and liveness probes with workload-appropriate initial delays and thresholds.
CI/CD
- PR: lint → typecheck → unit → integration → preview.
- Main: build → staging → smoke → production.
Health and shutdown
- Simple:
GET /health→{ "status": "ok" }. - Detailed: dependencies, uptime, version.
- Services MUST expose meaningful health and gracefully handle
SIGTERMwhen the workload requires it.
Configuration
Use environment variables (Twelve-Factor), separated by environment. Validate at startup and fail fast. NEVER commit secrets or hard-code NODE_ENV=production.
Rollback
Kubernetes: kubectl rollout undo. Vercel: vercel rollback. Docker: redeploy the previous pinned image.
Feature Flags
- Lifecycle: create → enable → 5% → 25% → 50% → 100% → remove flag and dead code.
- Every flag MUST have an owner, expiration, and rollback trigger. Remove within two weeks.
Checklists
- Pre-deploy, when applicable: passing tests, code review, environment variables, migrations, rollback plan.
- Post-deploy services: healthy, monitored, old pods terminated, outcome documented.
- Production services: passing tests; no hardcoded secrets; JSON logs; meaningful health; pinned versions; validated environment variables; resource limits; TLS; CVE scan; CORS; rate limiting; CSP/HSTS/X-Frame-Options; tested rollback; runbook; on-call.
- Apply security/CVE checks to executable or security-sensitive workloads.
Mobile Deployment
- EAS:
eas build:configure;eas build -p ios|android --profile preview;eas update --branch production;--auto-submit. - Fastlane: iOS
match/cert/sigh/pilot; Android Gradle/supply. - Keep credentials in environment/secret storage, never Git. Automate iOS development/distribution signing with
fastlane match; usekeytooland Google Play App Signing for Android. - TestFlight: internal instant; external 90 days/100 testers. Google Play: internal/beta/production. Expect 1–7 days for review.
- Rollback: EAS
eas update:rollback; native release → revert build; store release → reduce phased rollout.
Related Skills
williamlimasilva/tugboat
development
VerifiedTrustedCommunity
Anxiety-aware, evidence-driven collaboration for stalled or high-stakes work when a user says uncertainty, repeated setbacks, or lack of visible progress is causing significant anxiety or distress. Use immediately when explicitly invoked; when this fit is only inferred from the user's own account, ask permission before applying it. Preserve the user's ideal and turn grounded perspective-taking into persistent, bounded problem solving. Do not use to diagnose, provide therapy, manufacture certainty, or lower goals for reassurance.
SKILL.mdUpdated Aug 26, 2026
williamlimasilva/roslyn-analyzers
development
VerifiedTrustedCommunity
Build, review, debug, package, and test Roslyn diagnostic analyzers, code fix providers, and incremental source generators. Use for DiagnosticAnalyzer, CodeFixProvider, IIncrementalGenerator, IOperation analysis, Microsoft.CodeAnalysis dependency pinning, Roslyn test harnesses, C#/VB tests, and analyzer NuGet packaging.
SKILL.mdUpdated Aug 26, 2026
williamlimasilva/resx-source-generator-migration
testing
VerifiedTrustedCommunity
Migrates a project that uses checked-in .designer.cs files behind .resx to using a source-generator instead
SKILL.mdUpdated Aug 26, 2026
williamlimasilva/repo-standardizer
development
VerifiedTrustedCommunity
Polish any GitHub repository's surface — labels (emoji rating tiers, P0–P3 priority, impact severity), issue forms, PR template, CI workflows, CODEOWNERS, rulesets, docs. Repo meta & config only — no code logic touched. Use when creating a new repo or polishing an existing one.
SKILL.mdUpdated Aug 26, 2026