菜单
GitOps discipline — desired state in git, reconciliation, drift semantics, environment promotion. Tool-agnostic (works with any reconciler).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Context engineering — memory navigation, textual graph traversal, progressive disclosure, recovery. Load when assembling context for a task or when lost.
Implementation-side security discipline — headers, dependencies, secrets, authz. Load for hardening work (sec-ops domain).
Commit conventions, branching, anchors in messages, and the git safety rules. Load for any git operation beyond status/diff.
Anti-generic-AI design discipline — bans, tells, and the slop test. Load for ANY new UI surface or visual redesign. Inspired by Impeccable (Apache 2.0).
Motion & animation discipline — purpose, performance, reduced-motion. Load when work involves animation, transitions or scroll effects.
Microcopy discipline — buttons, errors, empty/loading/success states, alt text. Voice and tone come from the project's memory, not from this skill.
| name | gitops |
| description | GitOps discipline — desired state in git, reconciliation, drift semantics, environment promotion. Tool-agnostic (works with any reconciler). |
Owned by dev-ops; deep-dive of the GitOps summary in infra-patterns. Reconciler tooling from memory-long §stack.
Git is the only write path to the runtime. Desired state lives in a repo; a reconciler converges the runtime toward it continuously. Consequences that must hold:
git revert (which makes the release-engineering one-command rollback real for infra/workloads)git-workflow)infra-patterns cattle test)Detected drift is a decision, not noise: either someone had a reason (→ codify it, PR it) or nobody did (→ auto-revert). Reconcilers in enforce mode for prod, notify mode acceptable in sandboxes only · manual mutation in prod = incident-grade event · drift dashboards reviewed on cadence, not on curiosity.
Same manifests, different overlays/values per env — never forked env branches that drift apart · promotion is a PR moving a version/digest from staging values to prod values (reviewable, revertible, anchored) · app code and deployment manifests in separate repos or clearly separated paths — app CI shouldn't be able to mutate prod desired state directly.
Never plaintext in the repo, obviously — sealed/encrypted-at-rest references or external secret-store pointers · the reconciler's own credentials are the crown jewels: scope per-namespace/env, rotate, audit (see infra-security identity rules).
Prod state diff against git = empty (checked on schedule) · a change can be traced: PR → commit → reconcile event → runtime · freshly bootstrapped env from repo alone succeeds (the ultimate test, run in CI when feasible).