Cloud & DevOps Workflows

Maintain and operate the AI-Brain wiki — run lint, search, ingest, and fix common issues. Covers path facts, tool commands, and known pitfalls discovered during use.

Audit a codebase's documentation (README, SKILL.md, AGENTS.md, etc.) for gaps against the actual implementation. Finds undocumented commands, flags, config fields, and behaviors. Use when a feature has landed but docs weren't updated, after a session where docs drift was discovered, or as a pre-release check.

Create pull requests quickly in Azure DevOps repositories using Azure CLI (az repos pr create) with reliable auth fallbacks. Use this skill whenever the user asks to create/open/raise a PR for Azure DevOps, especially when they mention PAT auth, TFVARdevopsuserpat163ent, AZUREDEVOPSEXTPAT, or sourcing ~/dotfiles/sp/163ent-devops.sp. Prefer this skill over GitHub CLI or GitKraken tools for Azure DevOps remotes.

Deploy, configure, manage, and troubleshoot Coder self-hosted dev environments on a k3s Kubernetes cluster. Use when: installing Coder on k3s, creating or updating workspace templates, debugging 502 Bad Gateway errors, fixing code-server connectivity, managing Coder CLI authentication, pushing Terraform workspace templates, configuring PostgreSQL backend, debugging workspace pod failures, setting up per-user namespaces, or integrating Coder workspaces with LiteLLM / GPU nodes.

Install, wire, and validate a new Terraform CAF module or test resource into an ESLZ L2 blueprint. Use this whenever the user asks to add, deploy, wire, scaffold, or test a new module or resource in an ESLZ L2 folder, especially when they provide a GitHub module URL, a Terraform registry link, or ask for an L2 test resource. Trigger on phrases like "deploy an L2 resource", "add this module to L2", "wire this CAF module into ESLZ", "install this in L2", "create an L2 test resource", or "add this terraform module to the project blueprint". This skill is for integrating modules into an existing ESLZ L2 structure, not for writing a brand new standalone Terraform module from scratch.

Updates an existing ESLZ Terraform module to match a target provider version spec. Use when asked to upgrade, update, or bring a Terraform module up to spec with a provider version, when adding missing provider arguments to an existing ESLZ module, or when a user says "update this module", "bring it up to spec", or "add missing provider args". Also reviews and upgrades all dependent resources referenced in the module.

Migrate a Windows VM from the legacy windowsVMs module (list-based, v1) to the modern windowsVMsV2 module (map-based, v2) in an ESLZ L1 or L2 blueprint, including config translation, state moves, and nic-nsg cleanup — without destroying the VM. Use when a plan shows azurermwindowsvirtualmachine.VM must be replaced due to attributes not supported by the old module (e.g. vtpmenabled, securebootenabled, timezone), or when the user asks to migrate a VM from windowsVMs to windowsVMsV2.

Create an Azure DevOps Task to track updating a GCCO org (in AZDO-OrgMGMT-163ENT) to a new release. Use this whenever the user updates a terragrunt.hcl local.release value for an org and wants to log the change as a work item. Trigger on phrases like "create a task for this org update", "log this release update", "create a work item for this org", "track this update in DevOps", "create a DevOps task", "log that I updated the org", or when the user says they updated an org's release and want to record it.

Safe git operations — commits, pushes, branches, merges, and rebases with safety constraints enforced.

Respond to PR review comments from humans or AI reviewers. Fetches open review threads, triages each comment, implements fixes, posts a reply citing the commit, and optionally resolves threads. Use when a PR has received review feedback that needs actioning — trigger on "respond to PR comments", "address review feedback", "fix PR comments", "reply to review", or when review threads are open on a PR you authored.

Diagnose and fix GitHub authentication issues on Windows when pushing fails with "Repository not found" or wrong-account errors. Use when git push fails despite the repo existing, when multiple GitHub accounts are in play (personal + org), or when Windows Credential Manager has stale credentials. Trigger on phrases like "push failed", "repository not found", "wrong account", "gh auth", "credential", "git push 403", or any push error after a gh auth login.

Scaffold, build, and debug a Go CLI that talks to Kubernetes via client-go. Use when: creating a new Go CLI for Kubernetes, wiring up Cobra commands, applying/deleting Kubernetes resources from Go, waiting for pod readiness, streaming logs, or running kubectl-exec from Go code. Trigger on phrases like 'build a go cli for k8s', 'scaffold a kubernetes go tool', 'create/update/delete k8s resources from go', 'stream pod logs in go', 'wait for pod ready in go', 'kubectl exec from go'.

Simplify and refine recently modified code for clarity and consistency. Use after writing code to improve readability without changing functionality.

Creates new pi skills — scaffolds SKILL.md with frontmatter, registers in index.md, and logs the decision.

Generate, validate, and explain Azure resource names and tags following the SSC (Shared Services Canada) / GC Naming and Tagging Standard for Azure v2.1. Use this skill whenever the user wants to name an Azure resource, generate a compliant name, check if a name is valid, ask about naming rules or suffix codes, or get tagging guidance. Trigger on phrases like "name this resource", "what should I call my azure", "is this name valid", "generate a resource group name", "what suffix for", "what tags do I need", "check this azure name", "help me name", "what device type", "naming convention", "SSC naming standard". DO NOT trigger for general Azure questions unrelated to naming or tagging.

Run Tailscale inside a Kubernetes pod reliably — persistent identity, SSH host keys, RBAC, stop/start without re-registration, and API-based device cleanup. Use when: configuring tailscaled in a pod or StatefulSet, debugging Tailscale device getting a -1 suffix on pod restart, setting up Tailscale SSH in a container, storing Tailscale state in a K8s secret, managing Tailscale devices via API from a CLI or script, or asking why SSH fingerprints change after pod restart. Trigger on phrases like 'tailscale in kubernetes', 'tailscale pod keeps getting -1', 'tailscale ssh in container', 'TSKUBESECRET', 'tailscale state kube', 'tailscale device cleanup', 'ssh host key changes on pod restart'.

Scaffold a complete Terraform module for any Azure provider resource (azurerm or azuread) following the Shared Services Canada (SSC) Cloud Adoption Framework (CAF) naming and tagging standard. Use this skill whenever the user wants to create, scaffold, generate, or build a new Terraform CAF module for any Azure resource type — including when they provide a Terraform registry URL. Trigger on phrases like "create a CAF module for", "scaffold a terraform-azurerm-caf module", "build a CAF wrapper for", "create an ESLZ module for", even if the user just pastes a Terraform registry URL and says "make a module for this". The skill handles both azurerm (infrastructure) and azuread (Entra ID) resources. DO NOT trigger for general Terraform questions, editing existing modules, or non-Azure providers.

Run the standard terraform-docs update workflow for Terraform module repositories when users ask to regenerate or update README docs.

Import existing Azure resources into Terraform/Terragrunt state. Use when: terraform apply fails with "already exists", "resource already exists", "RoleAssignmentExists", "Permission being assigned already exists", or any error indicating a resource exists outside of state. Handles azurermprivatednszone, azurermroleassignment, azureadapproleassignment, and generic ARM resources. Supports both terraform import and terragrunt import.

Practical, provider-agnostic guide to naming Terraform resources, local blocks, and modules at scale. Use when designing new modules, reviewing naming consistency, establishing team naming standards, or asking "what should I name this resource?".

Run the standard validation workflow for Terraform module repositories. Trigger when users ask to "validate", "lint", "run checks", "verify Terraform changes", "check this module", or "run terraform validation".

Explain and recommend Terraform versioning best practices for requiredproviders and requiredversion in modules versus root stacks. Use this whenever the user asks about Terraform version constraints, provider pinning, whether to use >= or ~>, module compatibility policy, or how to structure versions.tf in reusable modules.