DevOps: DevOps & Deployment for Claude Code | AI Skill Market | AI Skill Market

DevOps: DevOps & Deployment for Claude Code | AI Skill Market | AI Skill Market

DevOps Rules

CI/CD Pipelines

Fail fast: run linting and unit tests before expensive integration tests — saves time and compute
Cache dependencies between runs —
```
npm install
```
on every build wastes minutes
Pin action versions with SHA, not tags —
```
actions/checkout@v3
```
can change, SHA is immutable
Secrets in environment variables, never in code or logs — mask them in CI output
Parallel jobs for independent steps — test, lint, and build can run simultaneously

Deployment Strategies

Blue-green: run new version alongside old, switch traffic atomically — instant rollback by switching back
Canary: route percentage of traffic to new version — catch issues before full rollout
Rolling: update instances incrementally — balance between speed and risk
Always have rollback plan before deploying — know exactly how to revert
Deploy the same artifact to all environments — build once, promote through stages

Infrastructure as Code

Version control all infrastructure — terraform, ansible, cloudformation in git
Never apply changes without plan/diff review —
```
terraform plan
```
before
```
apply
```
State files contain secrets — store remotely with encryption, never in git
Modules for reusable components — don't copy-paste infrastructure definitions
Separate environments with workspaces or directories — dev changes shouldn't affect prod

Containers

One process per container — containers are not VMs
Health checks are mandatory — orchestrators need them for routing and restarts
Don't run as root — use non-root USER in Dockerfile
Immutable images: config via environment, not baked in — same image in all environments
Tag images with git SHA, not just
```
latest
```
— know exactly what's deployed

Secrets Management

Never store secrets in environment files committed to git — use vault, sealed secrets, or CI secret storage
Rotate secrets regularly — automation makes rotation painless
Different secrets per environment — dev leak shouldn't compromise prod
Audit secret access — know who accessed what and when
Secrets in memory, not disk when possible — temp files persist longer than expected

Monitoring & Alerting

Four golden signals: latency, traffic, errors, saturation — start here
Alert on symptoms, not causes — "users seeing errors" not "CPU high"
Every alert must be actionable — if you can't do anything, it's noise
Dashboard per service with key metrics — one glance shows health
Structured logs (JSON) for machine parsing — grep works, but queries are better

Reliability

Define SLOs before building alerting — what does "healthy" mean for this service?
Error budgets: some failures are acceptable — 99.9% means 8 hours downtime/year is OK
Chaos engineering in staging — break things intentionally before prod breaks accidentally
Runbooks for common incidents — 3am is not the time to figure out recovery steps
Post-mortems without blame — focus on systems, not people

Common Mistakes

SSH into prod to fix things — all changes through automation, or you'll forget what you did
No staging environment — "works on my machine" doesn't mean works in prod
Ignoring flaky tests — they erode trust in CI, either fix or delete
Manual steps in deployment — if it's not automated, it'll be done wrong eventually
Monitoring only happy paths — check error rates and edge cases too

Networking

Internal services don't need public IPs — use private subnets, expose only load balancers
TLS everywhere, including internal traffic — zero trust, even behind firewall
DNS for service discovery — hardcoded IPs break when things move
Load balancer health checks separate from app health — LB needs fast response, app health can be thorough
Firewall default deny — explicitly allow what's needed, block everything else