deploy-authority
Editing infrastructure code, deploy workflows, or anything that could apply changes to live AWS infrastructure — Pulumi, GitHub Actions deploy/preview workflows, deploy roles.
来源信息
- 仓库
- districtr/districtr-v2
- 最近来源活动
- 2026年9月18日 14:42
- 检测到的 SKILL.md 语言
- 英语
- 星标
- 6
- 分支
- 3
安装方式
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
检查来源文件
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
正在显示 SKILL.md
SKILL.md
来源说明 · 只读预览- name
- deploy-authority
- description
- Editing infrastructure code, deploy workflows, or anything that could apply changes to live AWS infrastructure — Pulumi, GitHub Actions deploy/preview workflows, deploy roles.
- paths
- ["infra/**",".github/workflows/**"]
- user-invocable
- false
# Deploy Authority
## Constraints
- **Live infrastructure changes only through CI on a merged branch (`main`/`dev`).** Every pre-merge context — a local session, a PR-triggered workflow — is preview-only and must never hold credentials that can deploy, because pre-merge contexts execute unreviewed code. Concretely:
- `pulumi up` is CI's alone; local Pulumi work is `pulumi preview` only. Applying is deploying — it is not the build/test step of the infra world.
- `preview.yml` runs a PR's own code under the narrow `districtr-gha-preview` role; the admin-scoped `districtr-gha-deploy` role is reserved for `dev`/`main` workflows. Any new `pull_request`-triggered workflow stays on the narrow role.
`infra/README.md` is the deep reference (architecture, per-service table, deploy mechanics, rollback, secrets, DB access) — read it before editing anything in `infra/`. Dev-environment facts (compose stack, env files) live in `docs/overview.md`.
在 GitHub 查看