tsurf-deploy-validation

星标15

分支1

更新时间2026年7月1日 19:06

Validate a tsurf public repo or private overlay before deployment. Use when an agent is about to run checks, prepare a deploy, override a deploy target, verify rollback/recovery safety, or decide whether a tsurf host change is safe enough to push.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

来源

dangirsh

dangirsh/tsurf

打开 GitHub 仓库查看创作者相关仓库

下载

Tsurf Deploy Validation

Use this skill after a public tsurf or private overlay edit. Separate validation from deployment; a green eval is not authorization to deploy a real host.

Public Repo Validation

Run nix flake check --all-systems --no-build for cross-system evaluation.
If a Linux builder is available, build .#checks.x86_64-linux.shellcheck-tests and .#checks.x86_64-linux.unit-tests.
Run direct shell tests on the workstation when changing scripts: for test in tests/unit/*.bash; do bash "$test"; done.
Explain any skipped Linux/VM/live checks explicitly.
When changing credential proxy or nono network policy, run or explicitly account for .#vm-test-credential-proxy; eval checks alone are not enough.

Private Overlay Validation

Confirm the public repo worktree is clean or only contains intended changes.
In the private overlay, run nix flake check --no-build first. Use full builds only when the builder and secrets/state requirements are clear.
Verify deploy nodes point at the intended hosts. If using --target, confirm it overrides both SSH checks and deploy-rs hostname.
Confirm root SSH access and rollback path before any real deploy.
Confirm the overlay has not enabled services.nonoSandbox.allowDirectNetwork unless that direct-network risk is intentional and documented.

Deploy Rules

Deploy only from a private overlay.
Prefer ./scripts/deploy.sh --node <node>.
Use --target user@host only when intentionally overriding the deploy node's configured hostname, such as recovery or migration testing.
Avoid direct nixos-rebuild switch except for explicit emergency recovery.

同仓库更多 Skills

同仓库

tsurf-overlay-authoring

dangirsh/tsurf

Create or update a private tsurf overlay from discovered host facts. Use when an agent needs to author NixOS modules, choose public tsurf role modules, or preserve private services.

2026-07-0715

tsurf-host-discovery

dangirsh/tsurf

Inspect an existing or prospective NixOS host before applying tsurf. Use when an agent needs to choose a safe tsurf setup path, adapt to unknown disk/network/provider details, determine whether a host can use the public roles directly, or collect facts for a private overlay.

2026-07-0115

deploy

dangirsh/tsurf

Deploy tsurf NixOS config to a server

2026-03-2715

nix-test

dangirsh/tsurf

Run tests and manage .test-status for the tsurf repo

2026-03-2315

nix-module

dangirsh/tsurf

Create a new NixOS module for the tsurf repo

2026-03-2115

name	tsurf-deploy-validation
description	Validate a tsurf public repo or private overlay before deployment. Use when an agent is about to run checks, prepare a deploy, override a deploy target, verify rollback/recovery safety, or decide whether a tsurf host change is safe enough to push.

Tsurf Deploy Validation

Use this skill after a public tsurf or private overlay edit. Separate validation from deployment; a green eval is not authorization to deploy a real host.

Public Repo Validation

Run nix flake check --all-systems --no-build for cross-system evaluation.
If a Linux builder is available, build .#checks.x86_64-linux.shellcheck-tests and .#checks.x86_64-linux.unit-tests.
Run direct shell tests on the workstation when changing scripts: for test in tests/unit/*.bash; do bash "$test"; done.
Explain any skipped Linux/VM/live checks explicitly.
When changing credential proxy or nono network policy, run or explicitly account for .#vm-test-credential-proxy; eval checks alone are not enough.

Private Overlay Validation

Confirm the public repo worktree is clean or only contains intended changes.
In the private overlay, run nix flake check --no-build first. Use full builds only when the builder and secrets/state requirements are clear.
Verify deploy nodes point at the intended hosts. If using --target, confirm it overrides both SSH checks and deploy-rs hostname.
Confirm root SSH access and rollback path before any real deploy.
Confirm the overlay has not enabled services.nonoSandbox.allowDirectNetwork unless that direct-network risk is intentional and documented.

Deploy Rules

Deploy only from a private overlay.
Prefer ./scripts/deploy.sh --node <node>.
Use --target user@host only when intentionally overriding the deploy node's configured hostname, such as recovery or migration testing.
Avoid direct nixos-rebuild switch except for explicit emergency recovery.