tsurf-deploy-validation

스타15

포크1

업데이트2026년 7월 1일 19:06

Validate a tsurf public repo or private overlay before deployment. Use when an agent is about to run checks, prepare a deploy, override a deploy target, verify rollback/recovery safety, or decide whether a tsurf host change is safe enough to push.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

출처

dangirsh

dangirsh/tsurf

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Tsurf Deploy Validation

Use this skill after a public tsurf or private overlay edit. Separate validation from deployment; a green eval is not authorization to deploy a real host.

Public Repo Validation

Run nix flake check --all-systems --no-build for cross-system evaluation.
If a Linux builder is available, build .#checks.x86_64-linux.shellcheck-tests and .#checks.x86_64-linux.unit-tests.
Run direct shell tests on the workstation when changing scripts: for test in tests/unit/*.bash; do bash "$test"; done.
Explain any skipped Linux/VM/live checks explicitly.
When changing credential proxy or nono network policy, run or explicitly account for .#vm-test-credential-proxy; eval checks alone are not enough.

Private Overlay Validation

Confirm the public repo worktree is clean or only contains intended changes.
In the private overlay, run nix flake check --no-build first. Use full builds only when the builder and secrets/state requirements are clear.
Verify deploy nodes point at the intended hosts. If using --target, confirm it overrides both SSH checks and deploy-rs hostname.
Confirm root SSH access and rollback path before any real deploy.
Confirm the overlay has not enabled services.nonoSandbox.allowDirectNetwork unless that direct-network risk is intentional and documented.

Deploy Rules

Deploy only from a private overlay.
Prefer ./scripts/deploy.sh --node <node>.
Use --target user@host only when intentionally overriding the deploy node's configured hostname, such as recovery or migration testing.
Avoid direct nixos-rebuild switch except for explicit emergency recovery.

이 저장소의 다른 Skills

같은 저장소

tsurf-overlay-authoring

dangirsh/tsurf

Create or update a private tsurf overlay from discovered host facts. Use when an agent needs to author NixOS modules, choose public tsurf role modules, or preserve private services.

2026-07-0715

tsurf-host-discovery

dangirsh/tsurf

Inspect an existing or prospective NixOS host before applying tsurf. Use when an agent needs to choose a safe tsurf setup path, adapt to unknown disk/network/provider details, determine whether a host can use the public roles directly, or collect facts for a private overlay.

2026-07-0115

deploy

dangirsh/tsurf

Deploy tsurf NixOS config to a server

2026-03-2715

nix-test

dangirsh/tsurf

Run tests and manage .test-status for the tsurf repo

2026-03-2315

nix-module

dangirsh/tsurf

Create a new NixOS module for the tsurf repo

2026-03-2115

name	tsurf-deploy-validation
description	Validate a tsurf public repo or private overlay before deployment. Use when an agent is about to run checks, prepare a deploy, override a deploy target, verify rollback/recovery safety, or decide whether a tsurf host change is safe enough to push.

Tsurf Deploy Validation

Use this skill after a public tsurf or private overlay edit. Separate validation from deployment; a green eval is not authorization to deploy a real host.

Public Repo Validation

Run nix flake check --all-systems --no-build for cross-system evaluation.
If a Linux builder is available, build .#checks.x86_64-linux.shellcheck-tests and .#checks.x86_64-linux.unit-tests.
Run direct shell tests on the workstation when changing scripts: for test in tests/unit/*.bash; do bash "$test"; done.
Explain any skipped Linux/VM/live checks explicitly.
When changing credential proxy or nono network policy, run or explicitly account for .#vm-test-credential-proxy; eval checks alone are not enough.

Private Overlay Validation

Confirm the public repo worktree is clean or only contains intended changes.
In the private overlay, run nix flake check --no-build first. Use full builds only when the builder and secrets/state requirements are clear.
Verify deploy nodes point at the intended hosts. If using --target, confirm it overrides both SSH checks and deploy-rs hostname.
Confirm root SSH access and rollback path before any real deploy.
Confirm the overlay has not enabled services.nonoSandbox.allowDirectNetwork unless that direct-network risk is intentional and documented.

Deploy Rules

Deploy only from a private overlay.
Prefer ./scripts/deploy.sh --node <node>.
Use --target user@host only when intentionally overriding the deploy node's configured hostname, such as recovery or migration testing.
Avoid direct nixos-rebuild switch except for explicit emergency recovery.