debug-deploy
Skill1.1k starsChanged 59 days agoMITView on GitHub
Diagnose and resolve GitHub Actions application deployment, Terraform, migration-job, and Azure authorization failures.
In this repository9 other files it gives its agents.
- .github/copilot-instructions.mdCopilot instructions
- check-prodSkill
- gh-stackSkill
- query-prod-dbSkill
- reset-prod-submissionsSkill
- review-pr-commentsSkill
- review-terraformSkill
- ship-itSkill
- write-migrationSkill
The file
We split this skill into the rules it gives an agent
4 rules. About 0 are common, 3 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈3
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 8
Use gh run list --workflow=deploy.yml for Terraform and application release failures.
- Distinctive: line 18
Azure/OIDC authorization: verify repository variables/secrets, federated credential subject, Azure RBAC, and Microsoft Graph permissions …
- Distinctive: line 29
After a real fix, run the relevant local gate, push it through a PR, and monitor the new run.
- Distinctive: line 31
Never apply Terraform, mutate state, or change production access as part of diagnosis without explicit confirmation.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Debug Deploy
Use gh run list --workflow=deploy.yml for Terraform and application release
failures; the failed step shows which stage broke.
Inspect the selected run with gh run view <id> --log-failed. Diagnose evidence
from the failed step before changing code or infrastructure.
Common paths:
- Terraform lock: identify the lock owner and active workflows. Never force unlock until the user confirms the lock is stale and authorizes the exact lock ID.
- Azure/OIDC authorization: verify repository variables/secrets, federated credential subject, Azure RBAC, and Microsoft Graph permissions where used.
- Drift/not found: compare configuration, state, and Azure. Do not refresh, import, or recreate resources speculatively.
- Migration job: inspect the Container Apps Job execution and logs; verify image, command, managed identity, PostgreSQL role mapping, and environment.
- Tests/static checks: reproduce the exact failing command locally and fix the root cause.
- Quota/platform failure: confirm Azure resource health and quota evidence before recommending a capacity or SKU change.
After a real fix, run the relevant local gate, push it through a PR, and monitor the new run. Rerun unchanged code only for a demonstrated transient failure. Never apply Terraform, mutate state, or change production access as part of diagnosis without explicit confirmation.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.