Deploy compatible server, static-web, worker, scheduled-job, or reviewed remote-desktop workloads from GitHub or local source to Sealos Cloud, then run the default Runtime Truth Pass against the returned App URL, public route, authentication flow, logs, database state, and full resource footprint. Reject unsupported desktop, mobile, CLI, library, extension, hardware-dependent, mixed, and unidentified targets before readiness scoring or build. Use when the user asks to deploy a repository to Sealos or another cloud platform, or invokes "/sealos-deploy".
Deploy compatible server, static-web, worker, scheduled-job, or reviewed remote-desktop workloads from GitHub or local source to Sealos Cloud, then run the default Runtime Truth Pass against the returned App URL, public route, authentication flow, logs, database state, and full resource footprint. Reject unsupported desktop, mobile, CLI, library, extension, hardware-dependent, mixed, and unidentified targets before readiness scoring or build. Use when the user asks to deploy a repository to Sealos or another cloud platform, or invokes "/sealos-deploy".
metadata
{"author":"labring","compatibility":"Sealos auth/workspace are required for deploys. Docker, buildx, and gh CLI are required only when the selected path needs local build/push. git is required when cloning from a GitHub URL or when git metadata is needed. Node.js 18+ remains an optional accelerator. Phase 5 requires Python 3.8+ with PyYAML; root Compose conversion also requires kompose and may require crane when image tags are floating."}
Sealos Deploy
Compatibility
Sealos auth/workspace are required for deploys. Docker, buildx, and gh CLI are required only when the selected path needs local build/push. git is required when cloning from a GitHub URL or when git metadata is needed. Node.js 18+ remains an optional accelerator. Phase 5 requires Python 3.8+ with PyYAML; root Compose conversion also requires kompose and may require crane when image tags are floating.
Deploy compatible cloud workloads to Sealos Cloud, stopping unsupported targets
before build or deployment.
kubectl Safety Rules (all phases)
All kubectl commands MUST use the Sealos kubeconfig:
System tool installation requires user confirmation. If docker, gh, or is missing and the skill can install it for the current platform, ask first and only run the install command after the user explicitly replies .
kubectl
y
kubectl delete requires user confirmation. Before deleting any resource (deployment, service, ingress, PVC, database, etc.), always ask:
WARNING: About to delete <resource kind>/<resource name>. This data cannot be recovered. Confirm? (y/n)
Only proceed after user confirms. This applies even if the pipeline logic suggests deletion — always ask first.
Template API cleanup must include Instance CRs. Deployments created through scripts/deploy-template.mjs create instances.app.sealos.io/<app-name> in addition to App/workload resources. A cleanup is incomplete until instances.app.sealos.io, apps.app.sealos.io, workloads, Services, Ingresses, PVCs, and Pods are all checked.
Use this check when cleaning Template API test deployments:
Anti-example: do not report cleanup complete after only checking app,statefulset,svc,ingress,pvc,pod; that misses instances.app.sealos.io/<app-name> and leaves the Sealos Instance layer dirty.
Usage
/sealos-deploy <github-url>
/sealos-deploy # deploy current project
/sealos-deploy <local-path>
Build amd64 image & push to the selected registry (Docker Hub path assumes a public image at deploy time; omitting --registry keeps auto-detect behavior)
Resolve the current region, enforce private sensitive-args files on POSIX, post a local template YAML, and emit an allowlisted result with credential values redacted
Read-only JSON scan of Pod/init/main logs plus Warning Event convergence after readiness, login, and documented API or missing-static-asset checks
sealos-auth.mjs
node sealos-auth.mjs check|login|list|switch
Sealos Cloud authentication & workspace switching
All scripts output JSON. Run via Bash and parse the result.
For public web applications, run sealos-launchpad-network.mjs before HTTP smoke. Acceptance requires ok: true, an open public network, the expected Service port, and an App URL host match. The script emits an allowlisted network summary and excludes raw Launchpad application data, environment variables, Secrets, and kubeconfig content.
Runtime Event acceptance uses two scans. Capture the first report after readiness with no baseline, wait at least 60 seconds, then pass that report through --baseline for the final scan. Extend --min-window-seconds to cover one full known reconciliation, probe, or scheduled-work period. An initial Warning Event is an observation; a Warning that advances after the baseline, an unresolved referenced Secret, a Ready transition, a Pod replacement, or a restart delta is an active failure.
For intentional fault injection, retain a pre-injection report as evidence. After recovery reaches Ready, capture a fresh recovery baseline and compare the final scan against that recovery baseline after the full stability window.
Internal Skill Dependencies
This skill references knowledge files from co-installed internal skills. These are not user-facing — they are loaded on-demand during specific phases.
<SKILL_DIR> refers to the directory containing this SKILL.md. Sibling skills are at <SKILL_DIR>/../:
Confirm the repository root is a supported cloud workload
Any non-eligible result → stop
0.5 — Template Fast Path
Match GitHub repo to a configured Sealos template
No match, or match cannot materialize template YAML
1 — Assess
Clone repo (or use current project), analyze deployability
Score too low → stop
2 — Detect
Find existing image (Docker Hub / GHCR / README)
Found → jump to Phase 5
3 — Dockerfile
Generate Dockerfile if missing
Already has one → skip
4 — Build & Push
docker buildx → GHCR (auto via gh CLI) or Docker Hub (fallback)
—
5 — Template
Generate Sealos application template
—
5.5 — Configure
Guide user through app env vars and inputs
No inputs needed
6 — Deploy
Deploy template to Sealos Cloud
—
6.5 — Runtime Truth Pass
Verify Launchpad public networking, the actual Sealos runtime, logs, Event convergence, App URL, login path, object-storage flow, and resource footprint
User explicitly requests deploy-only output
Decision Flow
Input (GitHub URL / local path)
│
▼
[Phase 0] Preflight ── fail → guide user to fix and STOP
│ pass
▼
[Phase 0.5] Template fast path
│
├── materialized template match ───────┐
│ │
▼ │
[Phase 1] Assess ── not suitable → STOP with reason
│ suitable
▼
[Phase 2] Detect existing image
│
├── found (amd64) ────────────────────┐
│ │
▼ │
[Phase 3] Dockerfile (generate/reuse) │
│ │
▼ │
[Phase 4] Build & Push to registry │
│ │
◄─────────────────────────────────────┘
│
▼
[Phase 5] Generate Sealos Template
◄──────────────────────────────────────┘
│
▼
[Phase 5.5] Configure ── present env vars → ask user for inputs → confirm
│
▼
[Phase 6] Deploy to Sealos Cloud ── 401 → re-auth
│ 409 → instance exists
▼
[Phase 6.5] Runtime Truth Pass ── network/runtime/log/login issue → debug template or runtime config
│
▼
Done — app deployed ✓
Execution rule: Phase 1 must never start while Phase 0 still has unresolved entry blockers. Docker, gh, builder, and registry failures must be reported early, but only become hard blockers if the run later requires local build/push.
