checking-deploy

name	checking-deploy
description	Validate Kubernetes, Terraform, Helm, GitHub Actions, and Docker configs. Use when user says "deploy check", "validate deployment", "check k8s", "validate infrastructure", "check configs", or wants to verify infrastructure.
user-invocable	true
context	fork
allowed-tools	["Task","TaskOutput","TodoWrite","Bash(kubectl:*)","Bash(helm:*)","Bash(terraform:*)","Bash(actionlint:*)","Bash(docker:*)","Grep","Glob","mcp__perplexity-ask__perplexity_ask"]
argument-hint	["--background"]

Deployment Validation

Validate Kubernetes, Terraform, Helm, GitHub Actions, and Docker configs.

Use TodoWrite to track these 5 phases:

1. Detect infrastructure files
2. Spawn validation agent
3. Collect results
4. Research best practices (if needed)
5. Present summary

---

Parse $ARGUMENTS:

• --background → Run in background, return immediately with agent ID

---

Step 1: Detect Infrastructure Files

Use Glob to find infrastructure files (quick scan):

• **/*.yaml, **/*.yml - K8s, Helm, Kustomize
• .github/workflows/*.yml - GitHub Actions
• **/*.tf - Terraform
• **/Dockerfile*, **/docker-compose*.yml - Docker

---

Step 2: Spawn Validation Agent

Based on detected file types, spawn infra-engineer agent:

Task(
  subagent_type="infra-engineer",
  run_in_background={true if --background else false},
  description="Infrastructure validation",
  prompt="Validate {detected_types} infrastructure in this repository.

  Run these validations (only for detected file types):

  **Kubernetes:**
  - kubectl apply --dry-run=client -f <files>
  - Check: security contexts, resource limits, non-root users
  - Check: liveness/readiness probes defined
  - Check: no 'latest' image tags

  **Helm:**
  - helm lint <chart>
  - helm template validation
  - Check: values.yaml has sensible defaults

  **GitHub Actions:**
  - actionlint (if available)
  - Check: secrets not hardcoded
  - Check: permissions minimized (not 'write-all')
  - Check: pinned action versions (@vX.Y.Z not @main)

  **Terraform:**
  - terraform fmt -check
  - terraform validate
  - Check: no hardcoded credentials
  - Check: state backend configured

  **Dockerfile:**
  - Multi-stage builds where appropriate
  - Non-root user (USER directive)
  - Pinned base image tags (not :latest)
  - No secrets in build args

  Output format:
  PASS/FAIL per category with file:line for issues.
  Severity: CRITICAL / IMPORTANT / SUGGESTION"
)

If --background: Return agent ID immediately for later collection.

---

Step 3: Collect Results (if not background)

TaskOutput(task_id=<agent_id>, block=true)

---

Step 4: Research if Needed

For uncertain findings, use Perplexity for current best practices:

mcp__perplexity-ask__perplexity_ask with:
"Current best practices for {specific concern} in {technology} 2024-2025"

---

Step 5: Present Summary

DEPLOYMENT CHECK
================
Agent ID: {id} (use /agent:resume {id} to continue)

Kubernetes: [PASS/FAIL] - {details}
Helm: [PASS/FAIL] - {details}
GitHub Actions: [PASS/FAIL] - {details}
Terraform: [PASS/FAIL] - {details}
Docker: [PASS/FAIL] - {details}

CRITICAL Issues:
- file:line - issue description

IMPORTANT Issues:
- file:line - issue description

Recommendations:
- [prioritized list]

---

Execute validation now.