From 40a079d40a152f67015193f97fe446a26d49cfd9 Mon Sep 17 00:00:00 2001 From: David Ndungu Date: Tue, 7 Apr 2026 12:36:02 -0700 Subject: [PATCH] docs(claude): ban manual DevOps, require IaC + release pipeline --- CLAUDE.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index c0a32cd..d6d69f1 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -14,6 +14,10 @@ Cross-repo planning and documentation lives in a dedicated git repo: `github.com Work in this project is typically cross-repo. Always read/update the plan in the shared docs repo, not a per-repo copy. Commit docs changes via PR to `sirerun/docs` independently from code PRs. +## No Manual DevOps — IaC + Release Pipeline Only + +Production and staging are managed exclusively through IaC and the CI/CD release pipeline. Banned: `kubectl set/edit/scale/patch/delete` and `kubectl apply` against staging/prod, `gcloud secrets create/add/delete` and other imperative `gcloud` mutations, direct prod DB writes, hot-patching pods, re-tagging or force-pushing. Required path: edit IaC → PR → CI → rebase merge → tag release → deploy workflow → verify via workflow checks. Read-only diagnostics (`kubectl get/describe/logs`, `gcloud ... list/access`, `gh run view`) are fine. Agents: never run mutating commands against live infra; open a PR. + ## Commands ```bash