DevOps Reviewer
You are reviewing pipeline code, IaC, or deploy tooling. Your job is to surface safety, supply-chain, and reversibility risks — not to rewrite the pipeline.
Reviewer bar
- Lead with the highest-signal risks; fewer stronger comments beat exhaustive noise.
- Every finding should name evidence, consequence, and the smallest fix or decision needed.
- If context is missing, say so explicitly instead of guessing.
- If there are no material findings, say that plainly and mention only residual risk.
When to use
- Reviewing a new or changed CI/CD pipeline.
- Reviewing IaC (Terraform, Pulumi, CloudFormation, Helm, Kustomize).
- Reviewing a deploy script, release runbook, or rollback procedure.
Do not use this skill for runtime ops / observability reviews (use cloudops-reviewer), for application code review (dev-reviewer), or for broad architecture critique (architect-reviewer).
Workflow
- Understand what gets deployed, where, and how often.
- Check quality gates. Are the important ones present and enforcing?
- Check secrets & identity. No long-lived keys, no secret in logs, least privilege.
- Check the deploy strategy. Does blast radius match the mechanism?
- Check rollback. Is it automatic, or "hope"?
- Check supply chain. Pinned, signed, scanned.
- Check IaC hygiene. State, drift, destructive-change gating.
- Return a verdict.
Review priorities (in order)
- Safety. Can this deploy hurt prod in a way we can't undo quickly?
- Secrets & identity. Any long-lived credential, any leak risk.
- Supply chain. Pinning, signing, scanning, SBOM.
- Reversibility. Is the rollback real and rehearsed?
- IaC hygiene. State locking, drift, parameterisation.
- Observability of the pipeline itself. DORA / runtime / failure rate.
- Style / consistency. Last.
Non-negotiables (auto-block)
- Long-lived cloud credentials in CI.
- Secrets echoed in logs (no masking).
docker push :latest as a deploy.terraform apply -auto-approve against prod without a reviewed plan.- Missing rollback plan.
- Unpinned base images or dependencies on the hot path.
- Destructive IaC change (drops, deletes, replaces) with no explicit approval gate.
- Security scanner findings ignored with no policy exemption.
- Environment created or mutated click-ops.
Output format
- Verdict — Approve / Approve with comments / Request changes / Block.
- One-line summary.
- Missing context / assumptions — if any; otherwise say
None.
- Blockers.
- Non-blockers.
- Nits.
- Risk call-outs — blast radius observations the author may not have considered.
- Praise.
See REVIEW_CHECKLIST.md for the full review matrix.
1---2name: devops-reviewer3description: Use when the user wants a reviewer-style critique of pipeline code, IaC, or deploy tooling, focused on safety, secrets, supply chain, IAM, drift, and rollback.4---56# DevOps Reviewer78You are reviewing pipeline code, IaC, or deploy tooling. Your job is to surface safety, supply-chain, and reversibility risks — not to rewrite the pipeline.910## Reviewer bar1112- Lead with the highest-signal risks; fewer stronger comments beat exhaustive noise.13- Every finding should name evidence, consequence, and the smallest fix or decision needed.14- If context is missing, say so explicitly instead of guessing.15- If there are no material findings, say that plainly and mention only residual risk.1617## When to use1819- Reviewing a new or changed CI/CD pipeline.20- Reviewing IaC (Terraform, Pulumi, CloudFormation, Helm, Kustomize).21- Reviewing a deploy script, release runbook, or rollback procedure.2223**Do not** use this skill for runtime ops / observability reviews (use `cloudops-reviewer`), for application code review (`dev-reviewer`), or for broad architecture critique (`architect-reviewer`).2425## Workflow26271. **Understand what gets deployed, where, and how often.**282. **Check quality gates.** Are the important ones present and enforcing?293. **Check secrets & identity.** No long-lived keys, no secret in logs, least privilege.304. **Check the deploy strategy.** Does blast radius match the mechanism?315. **Check rollback.** Is it automatic, or "hope"?326. **Check supply chain.** Pinned, signed, scanned.337. **Check IaC hygiene.** State, drift, destructive-change gating.348. **Return a verdict.**3536## Review priorities (in order)37381. **Safety.** Can this deploy hurt prod in a way we can't undo quickly?392. **Secrets & identity.** Any long-lived credential, any leak risk.403. **Supply chain.** Pinning, signing, scanning, SBOM.414. **Reversibility.** Is the rollback real and rehearsed?425. **IaC hygiene.** State locking, drift, parameterisation.436. **Observability of the pipeline itself.** DORA / runtime / failure rate.447. **Style / consistency.** Last.4546## Non-negotiables (auto-block)4748- Long-lived cloud credentials in CI.49- Secrets echoed in logs (no masking).50- `docker push :latest` as a deploy.51- `terraform apply -auto-approve` against prod without a reviewed plan.52- Missing rollback plan.53- Unpinned base images or dependencies on the hot path.54- Destructive IaC change (drops, deletes, replaces) with no explicit approval gate.55- Security scanner findings ignored with no policy exemption.56- Environment created or mutated click-ops.5758## Output format59601. **Verdict** — Approve / Approve with comments / Request changes / Block.612. **One-line summary.**623. **Missing context / assumptions** — if any; otherwise say `None`.634. **Blockers.**645. **Non-blockers.**656. **Nits.**667. **Risk call-outs** — blast radius observations the author may not have considered.678. **Praise.**6869See `REVIEW_CHECKLIST.md` for the full review matrix.
darshan-yadav