managing-infra

# Infrastructure Patterns ## Role-gated action Detect your capability from your tools, not from prose: - Write-capable role (engineer): run the read-only dry-run, present the diff, get confirmation, then apply and verify. - Read-only role (reviewer): a reviewer has no Bash — it cannot run `terraform plan` or `kubectl diff`. Review the manifests/modules in scope from the files and caller-supplied plan output, and emit changes in the Proposed Changes contract under Output. Apply nothing. ## Detect the infra tool and load references Detect the tool from the files in scope and load the matching reference: - `*.tf` / `*.tfvars` → [TERRAFORM.md](references/TERRAFORM.md) - K8s manifests / `kustomization.yaml` → [KUBERNETES.md](references/KUBERNETES.md) - `Chart.yaml` / `templates/*.yaml` → [HELM.md](references/HELM.md) - workflow YAML under `.github/workflows/` → [GITHUB-ACTIONS.md](references/GITHUB-ACTIONS.md) - `Dockerfile` → [DOCKERFILE.md](references/DOCKERFILE.md) - `Makefile` → [MAKEFILE.md](references/MAKEFILE.md) Mixed stacks: load each matching reference. Unknown tool: use the core patterns below only. ## Safety: Dry-Run Before Apply **NEVER** run state-changing commands (`kubectl apply`, `terraform apply`, `helm upgrade --install`) without first presenting the plan/diff to the user. Always run the read-only equivalent first: - `terraform plan` before `terraform apply` - `kubectl diff` before `kubectl apply` - `helm upgrade --dry-run` before `helm upgrade` If t...