Skip to content

Add: New deploy-to-aks skill - #1827

Closed
Tom Gamble (gambtho) wants to merge 5 commits into
microsoft:mainfrom
gambtho:feature/deploy-to-aks-skill
Closed

Add: New deploy-to-aks skill#1827
Tom Gamble (gambtho) wants to merge 5 commits into
microsoft:mainfrom
gambtho:feature/deploy-to-aks-skill

Conversation

@gambtho

@gambtho Tom Gamble (gambtho) commented Apr 12, 2026

Copy link
Copy Markdown
Collaborator

Description

Adds a new deploy-to-aks skill that guides developers through deploying applications to existing Azure Kubernetes Service (AKS) clusters. This is complementary to the existing azure-kubernetes skill — while azure-kubernetes covers cluster provisioning and Day-0 configuration, deploy-to-aks focuses on the application deployment workflow: framework detection, containerization, manifest generation, safeguards validation, and deployment.

Scope: Quick Deploy

This skill is scoped to the quick deploy path — deploying to an existing AKS cluster with minimal questions. It detects the application framework, generates production-ready artifacts (Dockerfile, K8s manifests), validates against AKS Deployment Safeguards (DS001-DS013), and deploys with confirmation gates.

What's included

Core skill files:

  • SKILL.md — Main skill file with prerequisites, 5-step workflow, and references
  • phases/quick-deploy.md — Detailed quick deploy workflow (detection → generation → safeguards → deploy → verify)
  • references/ — Detection tables, safeguards checklist, workload identity patterns, rollback guidance

Knowledge packs (9 frameworks):

  • spring-boot, express, nextjs, fastapi, django, nestjs, aspnet-core, go, flask
  • Each provides framework-specific Dockerfile patterns, health endpoints, database profiles, writable paths, and common AKS issues

Templates (20 files):

  • Dockerfiles (Node, Python, Java, Go, .NET, Rust + matching .dockerignore per language)
  • Kubernetes manifests (deployment, service, ingress, gateway, HPA, PDB, etc.)
  • GitHub Actions CI/CD workflow
  • Mermaid diagram templates

Tests:

  • Trigger tests with 8 positive and 7 negative prompts
  • Unit tests for metadata, description, and frontmatter validation
  • Integration test scaffold
  • Registered in tests/skills.json

Token budget compliance

All files have been trimmed to fit within the repository's token limits:

  • SKILL.md: 949 tokens (under 5000 hard limit)
  • All reference files under 2000 token hard limit
  • Knowledge packs trimmed to under 2000 token fallback limit

Checklist

  • Tests pass locally (cd tests && npm test)
  • If modifying skill descriptions: verified routing correctness with integration tests (npm run test:skills:integration -- <skill>)
  • If modifying skill USE FOR / DO NOT USE FOR / PREFER OVER clauses: confirmed no routing regressions for competing skills
  • Version bumped in skill frontmatter (if skill files changed)

Related Issues

New skill submission — no related issues.

Copilot AI review requested due to automatic review settings April 12, 2026 09:35

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new deploy-to-aks skill under plugin/skills/ to guide “quick deploy” of an application to an existing AKS cluster, plus a matching test suite registered in tests/skills.json.

Changes:

  • Introduces a new skill (deploy-to-aks) with workflow, references, knowledge packs, and templates for Docker/Kubernetes/Bicep/CI.
  • Adds unit/trigger/integration tests + fixtures/snapshots for the new skill.
  • Registers the skill in the tests skill registry and integration schedule.

Reviewed changes

Copilot reviewed 49 out of 49 changed files in this pull request and generated 8 comments.

Show a summary per file
File Description
tests/skills.json Registers deploy-to-aks in skill lists and integration schedule.
tests/deploy-to-aks/unit.test.ts Unit tests for frontmatter parsing/metadata expectations.
tests/deploy-to-aks/triggers.test.ts Trigger prompt tests + snapshots for routing keywords.
tests/deploy-to-aks/integration.test.ts Integration test scaffold for real agent runs.
tests/deploy-to-aks/README.md Per-skill test README copied from template.
tests/deploy-to-aks/fixtures/sample.json Sample prompts/fixtures for the skill tests.
tests/deploy-to-aks/snapshots/triggers.test.ts.snap Snapshot baseline for extracted trigger keywords/description.
plugin/skills/deploy-to-aks/SKILL.md New skill entry point with prerequisites, workflow, references, and templates index.
plugin/skills/deploy-to-aks/phases/quick-deploy.md Detailed “quick deploy” workflow (detect → generate → validate → deploy → verify).
plugin/skills/deploy-to-aks/references/detection.md Framework/port/health endpoint detection tables.
plugin/skills/deploy-to-aks/references/safeguards.md DS001–DS013 safeguards checklist and examples.
plugin/skills/deploy-to-aks/references/workload-identity.md Workload Identity explanation + per-service patterns.
plugin/skills/deploy-to-aks/references/rollback.md Rollback/troubleshooting guidance for common failure points.
plugin/skills/deploy-to-aks/knowledge-packs/frameworks/spring-boot.md Spring Boot framework-specific deployment guidance.
plugin/skills/deploy-to-aks/knowledge-packs/frameworks/express.md Express/Fastify framework-specific deployment guidance.
plugin/skills/deploy-to-aks/knowledge-packs/frameworks/nextjs.md Next.js framework-specific deployment guidance.
plugin/skills/deploy-to-aks/knowledge-packs/frameworks/fastapi.md FastAPI framework-specific deployment guidance.
plugin/skills/deploy-to-aks/knowledge-packs/frameworks/django.md Django framework-specific deployment guidance.
plugin/skills/deploy-to-aks/knowledge-packs/frameworks/nestjs.md NestJS framework-specific deployment guidance.
plugin/skills/deploy-to-aks/knowledge-packs/frameworks/aspnet-core.md ASP.NET Core framework-specific deployment guidance.
plugin/skills/deploy-to-aks/knowledge-packs/frameworks/go.md Go framework-specific deployment guidance.
plugin/skills/deploy-to-aks/knowledge-packs/frameworks/flask.md Flask framework-specific deployment guidance.
plugin/skills/deploy-to-aks/templates/mermaid/architecture-diagram.md Mermaid architecture diagram template.
plugin/skills/deploy-to-aks/templates/mermaid/summary-dashboard.md Post-deploy summary “dashboard” template.
plugin/skills/deploy-to-aks/templates/k8s/namespace.yaml Namespace manifest template for workload isolation.
plugin/skills/deploy-to-aks/templates/k8s/serviceaccount.yaml ServiceAccount template with Workload Identity annotation.
plugin/skills/deploy-to-aks/templates/k8s/deployment.yaml Deployment template aligned to DS001–DS013 safeguards.
plugin/skills/deploy-to-aks/templates/k8s/service.yaml ClusterIP Service template.
plugin/skills/deploy-to-aks/templates/k8s/ingress.yaml Web App Routing ingress template.
plugin/skills/deploy-to-aks/templates/k8s/gateway.yaml Gateway API Gateway template (Istio).
plugin/skills/deploy-to-aks/templates/k8s/httproute.yaml Gateway API HTTPRoute template.
plugin/skills/deploy-to-aks/templates/k8s/hpa.yaml HPA template with scale behavior defaults.
plugin/skills/deploy-to-aks/templates/k8s/pdb.yaml PodDisruptionBudget template.
plugin/skills/deploy-to-aks/templates/k8s/configmap.yaml ConfigMap template for non-secret config.
plugin/skills/deploy-to-aks/templates/github-actions/deploy.yml GitHub Actions workflow template for build/push/deploy to AKS via OIDC.
plugin/skills/deploy-to-aks/templates/dockerfiles/node.Dockerfile Node.js production Dockerfile template.
plugin/skills/deploy-to-aks/templates/dockerfiles/python.Dockerfile Python production Dockerfile template.
plugin/skills/deploy-to-aks/templates/dockerfiles/java.Dockerfile Java/Spring Boot Maven Dockerfile template.
plugin/skills/deploy-to-aks/templates/dockerfiles/go.Dockerfile Go production Dockerfile template.
plugin/skills/deploy-to-aks/templates/dockerfiles/dotnet.Dockerfile .NET production Dockerfile template.
plugin/skills/deploy-to-aks/templates/dockerfiles/rust.Dockerfile Rust production Dockerfile template.
plugin/skills/deploy-to-aks/templates/bicep/main.bicep Orchestrator Bicep template (AKS/ACR/identity + optional backing services).
plugin/skills/deploy-to-aks/templates/bicep/main.bicepparam Example parameter file for the orchestrator.
plugin/skills/deploy-to-aks/templates/bicep/aks.bicep AKS cluster module template.
plugin/skills/deploy-to-aks/templates/bicep/acr.bicep ACR module template + AcrPull assignment.
plugin/skills/deploy-to-aks/templates/bicep/identity.bicep Managed Identity + federated credential module template.
plugin/skills/deploy-to-aks/templates/bicep/postgresql.bicep PostgreSQL Flexible Server module template.
plugin/skills/deploy-to-aks/templates/bicep/redis.bicep Redis module template + role assignment.
plugin/skills/deploy-to-aks/templates/bicep/keyvault.bicep Key Vault module template + role assignment.

Comment thread plugin/skills/deploy-to-aks/SKILL.md Outdated
Comment thread plugin/skills/deploy-to-aks/templates/bicep/main.bicepparam Outdated
Comment thread plugin/skills/deploy-to-aks/templates/bicep/main.bicep Outdated
Comment thread plugin/skills/deploy-to-aks/templates/k8s/configmap.yaml Outdated
Comment thread plugin/skills/deploy-to-aks/templates/bicep/main.bicep Outdated
Comment thread tests/deploy-to-aks/integration.test.ts Outdated
Comment thread tests/deploy-to-aks/README.md
Comment thread plugin/skills/deploy-to-aks/phases/quick-deploy.md
@gambtho
Tom Gamble (gambtho) force-pushed the feature/deploy-to-aks-skill branch from dc40a3e to 1bc9081 Compare April 12, 2026 10:11
Copilot AI review requested due to automatic review settings April 12, 2026 13:24
@gambtho
Tom Gamble (gambtho) force-pushed the feature/deploy-to-aks-skill branch from 1bc9081 to 85754f5 Compare April 12, 2026 13:24

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 49 out of 49 changed files in this pull request and generated 7 comments.

Comment thread plugin/skills/deploy-to-aks/SKILL.md
Comment thread plugin/skills/deploy-to-aks/SKILL.md
Comment thread tests/deploy-to-aks/README.md
Comment thread tests/deploy-to-aks/integration.test.ts
Comment thread .claude/settings.local.json Outdated
Comment thread docs/superpowers/plans/2026-04-12-fix-deploy-to-aks-review.md Outdated
Comment thread tests/deploy-to-aks/integration.test.ts
@gambtho
Tom Gamble (gambtho) force-pushed the feature/deploy-to-aks-skill branch from 85754f5 to 2d52b7e Compare April 12, 2026 14:50
Copilot AI review requested due to automatic review settings April 12, 2026 16:03
@gambtho
Tom Gamble (gambtho) force-pushed the feature/deploy-to-aks-skill branch from 2d52b7e to 984eebf Compare April 12, 2026 16:03

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 47 out of 48 changed files in this pull request and generated 4 comments.

Comment thread plugin/skills/deploy-to-aks/templates/github-actions/deploy.yml Outdated
Comment thread plugin/skills/deploy-to-aks/SKILL.md
Comment thread tests/deploy-to-aks/integration.test.ts
Comment thread plugin/skills/deploy-to-aks/SKILL.md
@gambtho
Tom Gamble (gambtho) force-pushed the feature/deploy-to-aks-skill branch from 984eebf to 8614cb0 Compare April 12, 2026 16:17
Copilot AI review requested due to automatic review settings April 12, 2026 19:08

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 47 out of 48 changed files in this pull request and generated 6 comments.

Comment thread plugin/skills/deploy-to-aks/references/detection.md Outdated
Comment thread plugin/skills/deploy-to-aks/templates/github-actions/deploy.yml
Comment thread plugin/skills/deploy-to-aks/references/workload-identity.md
Comment thread plugin/skills/deploy-to-aks/references/workload-identity.md
Comment thread plugin/skills/deploy-to-aks/templates/dockerfiles/dotnet.Dockerfile Outdated
Comment thread plugin/skills/deploy-to-aks/templates/dockerfiles/java.Dockerfile Outdated

@jongio Jon Gallant (jongio) left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The skill structure works well - phases, references, knowledge packs, and templates are cleanly separated. Safeguards coverage (DS001-DS013) is thorough, and the Dockerfiles are production-quality with multi-stage builds and non-root users.

Two things block merge:

  1. CI is red - 2 snapshot failures in triggers.test.ts. Run the snapshot update command and push.

  2. PR description is stale - The body still lists Bicep templates (main.bicep, acr.bicep, identity.bicep, etc.) that were removed. The "What's included" section references ~20 Bicep files that aren't in the current changeset. Update the description to match what's actually here.

See inline comments for specific template and test issues.

Comment thread .gitignore Outdated
Comment thread tests/deploy-to-aks/integration.test.ts
Comment thread plugin/skills/deploy-to-aks/templates/k8s/deployment.yaml
Comment thread plugin/skills/deploy-to-aks/templates/dockerfiles/go.Dockerfile Outdated
Comment thread plugin/skills/deploy-to-aks/templates/k8s/networkpolicy.yaml
- Update trigger snapshots to include 'diagnostic' keyword (fixes CI)
- Remove .claude/settings.local.json from .gitignore (unrelated to skill)
- Fix Go net/http detection: search .go source files, not go.mod require block
- Extend placeholder validation to catch <angle-bracket> style in k8s manifests
- Add import psycopg2 to PostgreSQL Python snippet in workload-identity.md
- Add import os to Redis Python snippet in workload-identity.md
- Fix dotnet.Dockerfile header comment: CMD -> ENTRYPOINT
- Fix java.Dockerfile header comment: remove HEALTHCHECK port reference
- Add HPA conflict warning comment to deployment.yaml replicas field
- Replace golang:1.23-alpine with <go-version> placeholder in go.Dockerfile
- Add commented-out egress section to networkpolicy.yaml

@jongio Jon Gallant (jongio) left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few things the earlier reviews didn't cover - mostly in the GitHub Actions template.

deploy.yml: Missing concurrency control and rollback handling - both are important for production CI/CD templates. Also no post-deploy verification even though the quick-deploy workflow describes it in Section 5.

workload-identity.md: Still uses "Azure AD" throughout - Microsoft renamed this to "Microsoft Entra ID" in 2023. Worth updating so users searching current docs don't get confused.

Comment thread plugin/skills/deploy-to-aks/templates/github-actions/deploy.yml
Comment thread plugin/skills/deploy-to-aks/templates/github-actions/deploy.yml
Comment thread plugin/skills/deploy-to-aks/references/workload-identity.md
Comment thread plugin/skills/deploy-to-aks/templates/github-actions/deploy.yml
- Add concurrency group to deploy.yml to prevent parallel deployment races
- Add post-deploy verification step (kubectl wait for pod readiness)
- Add rollback-on-failure step to deploy.yml
- Replace 'Azure AD' with 'Microsoft Entra ID' throughout workload-identity.md and deploy.yml comments
Copilot AI review requested due to automatic review settings April 16, 2026 08:05

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 47 out of 48 changed files in this pull request and generated 3 comments.

Comment thread plugin/skills/deploy-to-aks/templates/github-actions/deploy.yml Outdated
Comment thread tests/deploy-to-aks/README.md
Comment thread plugin/skills/deploy-to-aks/templates/dockerfiles/node.Dockerfile
- Fix concurrency group: env context unavailable at that scope; use github.workflow+github.ref_name
- Gate rollback on deploy step output flag to prevent rollback on pre-deploy failures
- Fix find|while read swallowing sed exit codes — switch to xargs
- Fail explicitly when k8s/ directory is missing (was silently skipped)
- Remove redundant kubectl set image (kubectl apply already handles image from manifests)
- Remove redundant kubectl wait (rollout status already guarantees pod readiness)
- Verify undo succeeded by running rollout status after kubectl rollout undo
…st README

- deploy.yml: create namespace before kubectl apply (avoids namespaces not found error)
- node.Dockerfile: use npm run build --if-present (safe for apps without a build script)
- tests/deploy-to-aks/README.md: align integration test prereqs with AGENTS.md
  (use npm install -g @github/copilot-cli instead of gh extension install)
Copilot AI review requested due to automatic review settings April 16, 2026 09:10

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 47 out of 48 changed files in this pull request and generated 3 comments.

Comment on lines +56 to +73
describe("Should NOT Trigger", () => {
// Near-miss: Azure but not AKS deployment
const azureNonAksPrompts: string[] = [
"set up Azure Functions for my API",
"configure Azure Front Door for my web app",
"create a storage account in Azure",
"monitor my App Service logs",
"configure Azure DevOps pipelines",
];

// Near-miss: other cloud providers
const otherCloudPrompts: string[] = [
"deploy my app to EKS on AWS",
"deploy to GKE using Cloud Build",
"configure Istio service mesh on minikube",
"create a Kubernetes operator in Go",
"set up EC2 instances",
];

Copilot AI Apr 16, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The negative prompts here include generic words that are very likely to match 2+ extracted keywords (e.g., "deploy", "build", "service", "monitor"), which will cause TriggerMatcher.shouldTrigger() to return triggered: true even though the test expects false. Consider rewriting the negative prompts to avoid multi-keyword overlaps with the skill’s keyword set (or switch to prompts that are clearly non-AKS and don’t include multiple common keywords present in the skill description/content).

Copilot uses AI. Check for mistakes.
Comment on lines +29 to +35
## MCP Tools

| Tool | Purpose | Required |
|------|---------|----------|
| `azure-documentation` | Fetch Azure documentation and configuration references | Yes |
| Terminal commands | Execute `kubectl`, `az`, `docker`, `gh` CLI commands | Yes |

Copilot AI Apr 16, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Markdown tables in this skill are written with leading double pipes (|| ... |), which renders as an extra empty column and is inconsistent with the rest of the repo’s markdown table formatting (single leading |). Update these tables to standard markdown table syntax (single | column separators) for correct rendering and readability (this pattern appears multiple times throughout the skill docs).

Copilot uses AI. Check for mistakes.
Comment on lines +23 to +34
# Layer caching: restore NuGet packages before copying the full source.
# Copy only project files first so the restore layer is cached independently.
COPY *.sln ./
COPY src/MyApp/*.csproj src/MyApp/

RUN dotnet restore src/MyApp/MyApp.csproj

# Copy everything and publish a Release build
COPY . .

RUN dotnet publish src/MyApp/MyApp.csproj \
--configuration Release \

Copilot AI Apr 16, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This Dockerfile template is hard-coded to a very specific repo layout (src/MyApp/MyApp.csproj, MyApp.dll) but the header comment only calls out replacing the project name. Consider converting the path and project name portions to explicit placeholders (or expand the comments to clearly indicate that the src/MyApp/... paths must also be updated), otherwise users are likely to copy/paste and end up with a broken build.

Copilot uses AI. Check for mistakes.

@jongio Jon Gallant (jongio) left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two follow-ups on the rollback fix and the Azure AD rename. Everything else I flagged earlier looks addressed.

@kvenkatrajan kvenkatrajan left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tom Gamble (@gambtho) - can deploy be another workflow within azure-kubernetes? Why are we creating a new deploy skill specifically for aks?

@kvenkatrajan

Copy link
Copy Markdown
Collaborator

chandraneel - can this be added a deploy workflow within the azure-kubernetes skill instead of creating a new one?

@github-actions

Copy link
Copy Markdown
Contributor

This PR has been automatically closed because it has unresolved review comments and no new commits in the last 28 days.

If you would still like to merge these changes, please:

  1. Resolve all outstanding review comments
  2. Reopen this PR

Thank you for your contribution!

@github-actions github-actions Bot closed this May 15, 2026
Tom Gamble (gambtho) added a commit to gambtho/GitHub-Copilot-for-Azure that referenced this pull request Jun 24, 2026
- SKILL.md: use inline double-quoted description (the repo frontmatter
  validator rejects >- folded scalars); the earlier folded-YAML premise
  was incorrect for this repo.
- configmap.yaml: make data an explicit empty map ({}) so Kubernetes
  accepts the ConfigMap (bare data: parses as null).
- deploy.yml: exclude <image> from the angle-bracket placeholder check
  so the workflow reaches the image-substitution step instead of failing
  on the intentionally-retained <image> token.

Refs: microsoft#1827
Tom Gamble (gambtho) added a commit that referenced this pull request Aug 7, 2026
* feat: relocate deploy-to-aks content under azure-kubernetes

Carry over the deploy workflow, references, knowledge packs, and
templates from the closed PR #1827 fork branch into a nested sub-skill
directory. Frontmatter, routing, and self-references are fixed in
follow-up commits.

Refs: #1827

* feat: rename sub-skill to azure-kubernetes-app-deploy

Rewrite frontmatter name and description (folded YAML per tests/AGENTS.md)
with explicit DO-NOT-USE routing to the azure-kubernetes parent and the
automatic-readiness sibling.

Refs: #1827

* fix: update managed-by label to new sub-skill name

Refs: #1827

* fix: correct go Dockerfile comments to reference ENTRYPOINT

The template uses ENTRYPOINT but two header comments still said CMD,
the same inconsistency review flagged and fixed on the dotnet template.

Refs: #1827

* feat: point azure-kubernetes to the app-deploy sub-skill

Add a Related-skills entry and a disambiguation note so cluster-vs-app
deploy intent routes to azure-kubernetes-app-deploy.

Refs: #1827

* test: add app-deploy stimuli to azure-kubernetes eval suite

Six Vally stimuli (routing, boundary, output, workspace-fixture) covering
the app-deploy sub-skill, plus a minimal Express fixture app. Grades on
the parent skill name; replaces the deprecated Jest suite from #1827.

Refs: #1827

* fix: address Copilot review on app-deploy sub-skill

- SKILL.md: use inline double-quoted description (the repo frontmatter
  validator rejects >- folded scalars); the earlier folded-YAML premise
  was incorrect for this repo.
- configmap.yaml: make data an explicit empty map ({}) so Kubernetes
  accepts the ConfigMap (bare data: parses as null).
- deploy.yml: exclude <image> from the angle-bracket placeholder check
  so the workflow reaches the image-substitution step instead of failing
  on the intentionally-retained <image> token.

Refs: #1827

* Genericize app-deploy Dockerfile base image tags

Replace pinned base-image versions with <LATEST_STABLE_*>
placeholders resolved at generation time. Refs: #2696

* Add app-deploy base image policy reference

Single source for base-image selection and <LATEST_STABLE_*>
resolution; documents the Microsoft/Azure Linux option. Refs: #2696

* Slim Python knowledge packs to durable guidance

Remove inline Dockerfiles and pinned versions; keep framework
deltas (collectstatic, init-container migrations, asyncpg,
writable paths). Add pointer table. Refs: #2696

* Slim Node knowledge packs to durable guidance

Remove inline Dockerfiles and pinned versions; keep framework
deltas (Fastify 0.0.0.0 bind, Next standalone + ISR cache mount,
Nest shutdown hooks). Add pointer table. Refs: #2696

* Slim compiled-language knowledge packs to durable guidance

Remove inline Dockerfiles and pinned versions; keep framework
deltas (Spring startupProbe, Go CGO/distroless + graceful
shutdown, ASP.NET Data Protection keys). Add pointer table.
Refs: #2696

* Reference canonical safeguards spec from app-deploy

Point to the sibling constraint spec as source of truth; keep only
the deploy-time auto-fix checklist. Refs: #2696

* Add base-image resolution step to quick-deploy

Resolve <LATEST_STABLE_*> at generation time; clarify DS009-safe
major-tag pinning; trim duplicated pack content. Refs: #2696

* Restore deploy-time image note in quick-deploy

Re-add the deployment.yaml image-tag timing note and the RBAC
admin-create alternative trimmed during token reduction. Refs: #2696

* Trim app-deploy SKILL.md under token limit

Move detail into references; add base-images.md to the reference
list. Refs: #2696

* Correct safeguards spec path and dotnet comment pin

Fix the relative path to the sibling constraint spec (../ -> ../../)
and de-pin a residual runtime-deps version in a dotnet template
comment. Refs: #2696

* De-pin Gateway API CRD install to latest stable

Replace the pinned gateway-api v1.0.0 release URL with the
releases/latest/download form so the skill installs current
stable CRDs at runtime instead of an Oct-2023 version. Refs: #2696

* Document distroless runtime placeholder exception

Note in base-images.md why Go/Rust runtime stages keep the literal
gcr.io/distroless/*-debian12 names instead of a <LATEST_STABLE_*>
placeholder, so the build/runtime asymmetry is not mistaken for a
bug. Refs: #2696
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants