huawei-codearts-devops-operations

# Purpose Operate the seven Huawei Cloud CodeArts services that are NOT project planning/design — CodeArts Repo, Check, Build, Artifact, TestPlan, Deploy, and Pipeline — using hcloud CLI (KooCLI) as the only mechanism. For each service this skill discovers existing resources, and where an operation's parameters are confirmed against its own API Reference page, creates/modifies and verifies them. Where an operation cannot be confirmed (most notably build-task creation/execution), this skill documents the gap explicitly and routes to a live probe, the console, or CodeArts Pipeline, instead of inventing a command. This skill is the operational counterpart to the companion `huawei-codearts-project-design` skill, which owns CodeArts Req (ProjectMan) project planning and creation. This skill never creates, renames, or deletes a CodeArts project; it only resolves an already-existing `project_id`. # Supported scenario - Source: an operation intent naming exactly one target service (repo, check, build, artifact, testplan, deploy, or pipeline) and an action (discover, create, or verify) - Target: a resource within that service (repository, check task, build task config, artifact repository, test plan/case, host cluster/environment/deployment task, or pipeline/pipeline run), fully identified by its own ID - Mechanism: each service's own REST API called through hcloud CLI, under that service's own `hcloud` service name (see table below); no dedicated MCP exists for any of the seven - Storage: none beyond the artifacts this skill itself generates - Topology: single-region, single-service operation per invocation | Service | `hcloud` service name | Former/legacy name | |---|---|---| | CodeArts Repo | `CodeArtsRepo` | CodeHub | | CodeArts Check | `CodeCheck` | CodeCheck (this is still the current KooCLI/API Explorer service name) | | CodeArts Build | `CodeArtsBuild` | CodeCI / CloudBuildEx | | CodeArts Artifact | `CodeArtsArtifact` | CloudArtifact | | CodeArts TestPlan | `CloudTest` | CloudTest (this is still the current KooCLI/API Explorer service name) | | CodeArts Deploy | `CodeArtsDeploy` | CloudDeploy | | CodeArts Pipeline | `CodeArtsPipeline` | CloudPipeline | # When to use this skill - Creating or listing CodeArts Repo repositories, and querying their details - Listing CodeArts Check tasks and reading their code-quality metrics and issues - Inspecting CodeArts Build task configuration differences (the only confirmed operation for this service) - Listing CodeArts Artifact package repositories and querying Maven repository/credential info - Listing CodeArts TestPlan test plans and attaching existing test cases to a plan - Creating a CodeArts Deploy host cluster, listing environments/hosts, and starting an existing deployment task - Listing CodeArts Pipelines, running a pipeline, and checking a pipeline run's status - Auditing what resources exist across any of these seven services in a tenant/region/project # When not to use this skill - Creating, renaming, deleting, or configuring the basic design of a CodeArts Req (ProjectMan) project — use the companion `huawei-codearts-project-design` skill - Managing work items, iterations, sprints, or Wiki content inside a project — out of scope for both this skill and the project-design skill - Authoring a CodeArts Pipeline's stage/job graph from scratch via CLI — this skill runs and inspects pipelines whose definition already exists (console, YAML, or an externally supplied `definition` payload) - Uploading/downloading actual package files to/from a CodeArts Artifact repository, or performing git operations (clone/push/pull/merge) against a CodeArts Repo repository — use the package manager or git CLI directly, not hcloud - Creating or starting a CodeArts Check task, or creating/running a CodeArts Build task, when no confirmed hcloud operation exists for that action (see the per-service capability gaps) and neither the console nor a CodeArts Pipeline substitute is acceptable to the requester - When hcloud CLI is not available and cannot be installed # Required inputs - target_service (one of: repo, check, build, artifact, testplan, deploy, pipeline) - action (discover, create, or verify — the create action is only available for the services/operations listed as confirmed or freshly probed in `# Per-service operations`) - source_region - project_id or project_name (used to resolve project_id via ProjectMan) - approval_owner (required whenever action is create) # Optional inputs - repo_name / repository_uuid (CodeArts Repo) - task_id (CodeArts Check) - job_id (CodeArts Build) - repository_name / tenant_id (CodeArts Artifact) - plan_id / testcase_id_list / service_id (CodeArts TestPlan) - application_id / environment_id / host_cluster_name / deployment_task_id (CodeArts Deploy) - pipeline_id / pipeline_definition (CodeArts Pipeline) - description (where the target operation supports one) # Required MCPs None. All operations across all seven services are performed via hcloud CLI. # Optional MCPs - huaweicloud-ticket (only to open a support ticket if a capability-gap probe fails for a critical-path operation and manual escalation is desired) # Tool selection policy - Use hcloud CLI for ALL operations across CodeArts Repo, Check, Build, Artifact, TestPlan, Deploy, and Pipeline: discovery, creation (where confirmed), and verification - Never use a generic `hcloud CodeArts ...` service name; each service has its own distinct name (`CodeArtsRepo`, `CodeCheck`, `CodeArtsBuild`, `CodeArtsArtifact`, `CloudTest`, `CodeArtsDeploy`, `CodeArtsPipeline`) — using the wrong one, or inventing `CodeArts` as a catch-all, is a Rule violation, not a shortcut - Never assume an operation not in a service's confirmed-operations table (see `# Per-service operations`) is available without probing it live first (`hcloud <SERVICE_NAME> <OPERATION> --help`) - Never use huaweicloud-ticket to substitute a missing capability with an invented command; it is for support escalation only - Never use this skill to create, rename, or delete a CodeArts Req project; resolve `project_id` read-only via `hcloud ProjectMan ListProjectsV4` and otherwise defer to the companion project-design skill - For CodeArts Build specifically, if no create/run operation can be confirmed live, prefer routing the build through an already-defined CodeArts Pipeline job over the console when both are acceptable to the requester, since it keeps the action auditable through this same skill's Pipeline module # Safety and approval gates 1. Any create/update/start/run operation (across any of the seven services) requires explicit approval before execution 2. Reusing an existing resource instead of creating a new one (for example, a repository that already exists with the intended name) requires explicit confirmation from the approval owner 3. Any delete/stop-style rollback action requires explicit approval and must first be confirmed to actually exist for that service (see `# Rollback` below) — never assumed 4. Starting a CodeArts Deploy deployment task or running a CodeArts Pipeline are treated as high-impact write actions (they can affect running environments) and require explicit approval every time, even on repeat requests 5. Adding members/roles to a CodeArts Repo repository, or attaching test cases to a CodeArts TestPlan plan, requires explicit approval # Rules 1. Each of the seven services in this skill's scope is exposed through hcloud CLI under its own distinct service name; there is no generic `CodeArts` service name and no dedicated MCP for any of them. [VERIFIED_FROM_PUBLIC_API_DOCS] 2. **CodeArts Repo** is exposed under the hcloud service name `CodeArtsRepo` (formerly `CodeHub`). Confirmed operations with a fully verified parameter table: `CreateRepository`, `ListUserAllRepositories`, `ShowRepository`. AddSshKey, ListSshKeys, ListRepoMembers, AddRepoMembers, CreateNewBranch, ListBranchesByRepositoryId, and DeleteRepository are confirmed to exist for CodeArtsRepo (listed by hcloud CodeArtsRepo --help / API Explorer), but their exact parameter sets were not independently checked against each operation's own API Reference page during authoring. [VERIFIED_FROM_PUBLIC_API_DOCS] [PROBE_HELP_BEFORE_USE] 3. **CodeArts Check** is exposed under the hcloud service name `CodeCheck` (formerly `CodeCheck (this is still the current KooCLI/API Explorer service name)`). Confirmed operations with a fully verified parameter table: `ShowTaskListByProjectIdV2`, `ShowTaskCmetrics`, `ShowTaskDetailV2`, `ShowTaskDefectsV2`. No operation to create or trigger-run a check task was found in the public CodeArts Check API Reference under the CodeCheck service; check tasks are created and started from the CodeArts Check console or from a CodeArts Pipeline job. This skill only lists tasks and reads their metrics/issues via hcloud; it does not create or start check tasks. [VERIFIED_FROM_PUBLIC_API_DOCS] [USE_CONSOLE_OR_PIPELINE_FOR_CREATE] 4. **CodeArts Build** is exposed under the hcloud service name `CodeArtsBuild` (formerly `CodeCI / CloudBuildEx`). Confirmed operations with a fully verified parameter table: `ShowJobConfigDiff`. This is this skill's most significant capability gap, analogous to CreateProjectV4 in the companion CodeArts Req skill. The legacy build-task operations (CreateBuildJob, UpdateBuildJob, ListDeployTasks-style job listing) live under the older 'CodeCI' API namespace and several are explicitly marked deprecated or 'Out-of-date'/'Unavailable Soon' in their own API Reference pages. The current, non-deprecated CodeArtsBuild namespace only had ShowJobConfigDiff confirmed with a full parameter table at authoring time. No create-build-task or run/start-build-task operation could be confirmed under the current CodeArtsBuild service name. Before relying on any create/run/list build operation, this skill MUST probe `hcloud CodeArtsBuild --help` live and cross-check the operation's own API Explorer 'CLI Examples' tab; if the operation is missing, deprecated, or its parameters cannot be confirmed, use the CodeArts Build console, or drive the build through a CodeArts Pipeline job (see the pipeline module) instead of guessing a command. [VERIFIED_FROM_PUBLIC_API_DOCS] [PROBE_THEN_FALLBACK_TO_PIPELINE_OR_CONSOLE] 5. **CodeArts Artifact** is exposed under the hcloud service name `CodeArtsArtifact` (formerly `CloudArtifact`). Confirmed operations with a fully verified parameter table: `ListAllRepositories`, `ShowMavenInfo`, `ShowFileTree`. CreateArtifactory (creating a non-Maven repository) is confirmed to exist by name (it appears as the documented 'next topic' after DeleteRepository in the Repository Management section) but its full request-body parameter table was not independently fetched/verified during authoring. Probe `hcloud CodeArtsArtifact CreateArtifactory --help` and cross-check the CLI Examples tab before scripting a create call. [VERIFIED_FROM_PUBLIC_API_DOCS] [PROBE_HELP_BEFORE_USE] 6. **CodeArts TestPlan** is exposed under the hcloud service name `CloudTest` (formerly `CloudTest (this is still the current KooCLI/API Explorer service name)`). Confirmed operations with a fully verified parameter table: `CreateTestCaseInPlan`. ShowPlans (listing test plans in a project) is confirmed to exist and to sit immediately before CreateTestCaseInPlan in the Test Plan Management section (GET .../plans, consistent with the sibling path .../plans/{plan_id}/testcases/batch-add), but its own query-parameter table was not independently fetched. In addition, KooCLI's exact CLI syntax for the testcase_id_list ARRAY body parameter of CreateTestCaseInPlan was not observed live; confirm the current array syntax with `hcloud CloudTest CreateTestCaseInPlan --help` or the operation's CLI Examples tab before scripting it, rather than guessing a bracket/comma format. [VERIFIED_FROM_PUBLIC_API_DOCS] [PROBE_HELP_BEFORE_USE] 7. **CodeArts Deploy** is exposed under the hcloud service name `CodeArtsDeploy` (formerly `CloudDeploy`). Confirmed operations with a fully verified parameter table: `CreateHostCluster`, `ListEnvironments`, `ListEnvironmentHosts`, `StartDeployTask`. The application/task-listing operation ListDeployTasks (GET /v2/{project_id}/tasks/list) is confirmed to exist and confirmed under the CodeArtsDeploy service name, but its own API Reference page explicitly states it 'will not be maintained after September 30, 2024' and directs callers to use ListAllApp instead; ListAllApp's parameters were not independently verified during authoring. Do not use ListDeployTasks for new automation; probe `hcloud CodeArtsDeploy ListAllApp --help` first, and treat deployment-task/application listing as needing live confirmation. [VERIFIED_FROM_PUBLIC_API_DOCS] [AVOID_DEPRECATED_OP_PROBE_REPLACEMENT] 8. **CodeArts Pipeline** is exposed under the hcloud service name `CodeArtsPipeline` (formerly `CloudPipeline`). Confirmed operations with a fully verified parameter table: `CreatePipelineNew`, `RunPipeline`, `ShowPipelineRunDetail`. ListPipelines is confirmed to exist (its JSON response shape was observed in the public API Reference example), but its query-parameter table (pagination fields such as offset/limit, and any filters) was not independently fetched during authoring. CreatePipelineNew's 'definition' body field is a large nested JSON structure (stages/jobs/steps) whose full schema was only partially observed via example payloads; do not hand-author a 'definition' value from guesswork — generate it from the console's 'Create Pipeline' / YAML editor, or from a previously exported pipeline, and pass it through unmodified. [VERIFIED_FROM_PUBLIC_API_DOCS] [PROBE_HELP_AND_REUSE_CONSOLE_EXPORTED_DEFINITION] 9. DISCOVER BEFORE CREATE: for every service, always run its discovery/list operation before creating anything; never hardcode `project_id`, `repository_uuid`, `task_id`, `job_id`, `application_id`, `environment_id`, `plan_id`, or `pipeline_id` — resolve them via read operations. [VERIFIED_FROM_PUBLIC_API_DOCS] 10. VERIFY AFTER EVERY WRITE: every create/update/start/run operation must be followed by that same service's read/verify operation (see `# Per-service operations`). [VERIFIED_FROM_PUBLIC_API_DOCS] 11. Every write operation requires explicit approval before execution. [INFERRED] 12. This skill's scope excludes CodeArts Req (ProjectMan) project planning/design entirely; it only resolves an existing `project_id` via `hcloud ProjectMan ListProjectsV4` and never creates, renames, or deletes a project. [INFERRED] (explicit scope boundary requested when this skill was authored) 13. Never include secrets (AK, SK, tokens, passwords) in commands, examples, files, or logs; use the credentials already configured in the local hcloud profile. [INFERRED] 14. Each of the seven service modules is independent: a request scoped to one service must not require having exercised any other service's workflow first, and must not silently issue commands against a different service to compensate for a gap. [INFERRED] (explicit design requirement requested when this skill was authored) 15. This skill was authored and verified from the official public CodeArts API Reference pages for each of the seven services (specifically each operation's own "Online Debugging"/"CLI Examples" link, which exposes the literal `hcloud` service name). It was **not** executed against a live hcloud CLI installation or a live Huawei Cloud tenant. The first real use of this skill for any given service in any environment MUST start with that service's discovery probe (`hcloud <SERVICE_NAME> --help`) before relying on any operation not in its confirmed-operations table. [NOT_LIVE_TESTED] # Prerequisites | Tool or resource | Required | Purpose | Verification | |---|---:|---|---| | hcloud CLI (KooCLI) | Yes | All operations across all seven services | `hcloud version` | | Huawei Cloud authentication (AK/SK) | Yes | API access | `hcloud configure show --cli-profile=default` | | An existing CodeArts project | Yes | project_id required by nearly every operation in scope | `hcloud ProjectMan ListProjectsV4 --search=` | | Target region (CodeArts-supported) | Yes | Service region/endpoint | Confirm via a successful `hcloud <SERVICE_NAME> --help`/discovery call | | Per-service resource-creation permission | Only if action=create | Ability to create/modify the target resource | Confirmed only by a successful call or console check | | Approval owner | Yes (for create actions) | Authorizes write operations | Specified in intent | | Pre-existing check task / build task / test plan+cases / application+environment+deploy task / pipeline definition | Depends on target_service | This skill does not create these container resources for Check, Build, TestPlan, Deploy, or Pipeline — only operates within them | See `# Prerequisites` above | | huaweicloud-ticket MCP | No | Support escalation if a capability gap blocks a request | MCP availability check | See `# Prerequisites` above for full detail. # Workflow This skill's workflow has a short, generic front section (parse intent, discover auth/region/project) common to all seven services, followed by exactly one per-service module selected by `target_service`. The per-service modules are NOT sequential steps of one pipeline — only the module matching the request's `target_service` is executed. ## STEP 1 — PARSE INTENT **Classification: AUTOMATED** **Objective**: Extract and validate target_service, action, region, project reference, and any service-specific identifiers. **Inputs**: User request. **Preconditions**: None. **Command**: None (parsing logic). **Approval requirement**: None. **Verification**: Confirm target_service is exactly one of `repo`, `check`, `build`, `artifact`, `testplan`, `deploy`, `pipeline`, and action is one of `discover`, `create`, `verify`. **Expected result**: Complete intent object with a single target_service. **Failure action**: If target_service is missing, ambiguous, or not one of the seven, STOP and request clarification. Do not guess which service was meant. **Evidence artifact**: `artifacts/codearts-ops-intent.json` ## STEP 2 — DISCOVER AUTHENTICATION, REGION, AND PROJECT **Classification: ASSISTED** **Objective**: Verify hcloud CLI is installed/configured, and resolve the CodeArts project_id. **Inputs**: source_region, project_id_or_project_name. **Preconditions**: hcloud CLI installed (see `# Prerequisites` above). **Commands** (read-only): ```bash hcloud version hcloud configure show --cli-profile=default hcloud ProjectMan ListProjectsV4 --cli-region=<REGION> --offset=0 --limit=10 --search="<PROJECT_NAME>" ``` **Approval requirement**: None. **Verification**: Version and profile confirmed; exactly one project resolves for the given name/ID. **Expected result**: Authentication valid; `project_id` resolved. **Failure action**: STOP. If zero or multiple projects match, do not guess; if zero, this indicates the project-design step (a different skill) has not run yet. **Evidence artifact**: `artifacts/codearts-ops-auth-discovery.json`, `artifacts/codearts-ops-project-resolution.json` ## STEP 3 — CONFIRM TARGET SERVICE REACHABILITY **Classification: ASSISTED** **Objective**: Confirm the target service responds and list its operations. **Inputs**: target_service. **Preconditions**: Step 2 completed. **Command** (read-only): `hcloud <SERVICE_NAME> --help`, using the exact service name from the table in `# Supported scenario` above. **Approval requirement**: None. **Verification**: The command lists operations rather than erroring. **Expected result**: Target service confirmed reachable; the confirmed/unconfirmed operation split for this service (see `# Per-service operations`) is reviewed. **Failure action**: STOP. Report the region/service/connectivity error. **Evidence artifact**: `artifacts/codearts-ops-service-capability-probe.json` ## STEP 4 — RUN THE TARGET SERVICE'S MODULE **Classification: ASSISTED** **Objective**: Execute the per-service Discover → (Plan) → Execute → Verify sequence documented in `# Per-service operations`, using ONLY that service's confirmed (or freshly-probed) operations. **Inputs**: project_id, action, service-specific identifiers. **Preconditions**: Steps 1-3 completed. Consult the dedicated file for the target service: - `repo` → see `# Per-service operations` → CodeArts Repo (service: `CodeArtsRepo`) - `check` → see `# Per-service operations` → CodeArts Check (service: `CodeCheck`) - `build` → see `# Per-service operations` → CodeArts Build (service: `CodeArtsBuild`) — the most gap-affected module; see `GAP-CODEARTS-OPS-103` - `artifact` → see `# Per-service operations` → CodeArts Artifact (service: `CodeArtsArtifact`) - `testplan` → see `# Per-service operations` → CodeArts TestPlan (service: `CloudTest`) - `deploy` → see `# Per-service operations` → CodeArts Deploy (service: `CodeArtsDeploy`) - `pipeline` → see `# Per-service operations` → CodeArts Pipeline (service: `CodeArtsPipeline`) If action is `discover`: run only the discovery command from that file; stop after recording results. If action is `create`: request explicit approval, then run the create command from that file (only if it is a confirmed operation, or was freshly probed successfully), then immediately run the verify command. If action is `verify`: run the verify command from that file directly (useful for re-checking a resource created in a previous run). **Approval requirement**: EXPLICIT for any create/write action; none for discover/verify. **Verification**: Per the target service's file. **Expected result**: The requested resource state confirmed. **Failure action**: STOP on any error; do not retry with a different, invented command; do not fall back to a different service without a new approval and a documented reason (Build → Pipeline is the one pre-approved fallback pattern, and even that still needs explicit approval for the Pipeline run itself). **Evidence artifact**: `artifacts/codearts-ops-execution-result.json`, `artifacts/codearts-ops-verification.json` ## STEP 5 — CLOSURE **Classification: AUTOMATED** **Objective**: Generate final summary, evidence, and follow-up actions. **Inputs**: All artifacts from Steps 1-4. **Preconditions**: All previous steps completed. Generate: - Final summary (target_service, operation used, action, region, project_id, result)