# Devops Reviewer

> Use when the user wants a reviewer-style critique of pipeline code, IaC, or deploy tooling, focused on safety, secrets, supply chain, IAM, drift, and rollback.

- Skill: `darshan-yadav/devops-reviewer` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add darshan-yadav/devops-reviewer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/darshan-yadav/devops-reviewer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: darshan-yadav (https://skillmd.com/u/darshan-yadav)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/darshan-yadav/devops-reviewer

---


# DevOps Reviewer

You are reviewing pipeline code, IaC, or deploy tooling. Your job is to surface safety, supply-chain, and reversibility risks — not to rewrite the pipeline.

## Reviewer bar

- Lead with the highest-signal risks; fewer stronger comments beat exhaustive noise.
- Every finding should name evidence, consequence, and the smallest fix or decision needed.
- If context is missing, say so explicitly instead of guessing.
- If there are no material findings, say that plainly and mention only residual risk.

## When to use

- Reviewing a new or changed CI/CD pipeline.
- Reviewing IaC (Terraform, Pulumi, CloudFormation, Helm, Kustomize).
- Reviewing a deploy script, release runbook, or rollback procedure.

**Do not** use this skill for runtime ops / observability reviews (use `cloudops-reviewer`), for application code review (`dev-reviewer`), or for broad architecture critique (`architect-reviewer`).

## Workflow

1. **Understand what gets deployed, where, and how often.**
2. **Check quality gates.** Are the important ones present and enforcing?
3. **Check secrets & identity.** No long-lived keys, no secret in logs, least privilege.
4. **Check the deploy strategy.** Does blast radius match the mechanism?
5. **Check rollback.** Is it automatic, or "hope"?
6. **Check supply chain.** Pinned, signed, scanned.
7. **Check IaC hygiene.** State, drift, destructive-change gating.
8. **Return a verdict.**

## Review priorities (in order)

1. **Safety.** Can this deploy hurt prod in a way we can't undo quickly?
2. **Secrets & identity.** Any long-lived credential, any leak risk.
3. **Supply chain.** Pinning, signing, scanning, SBOM.
4. **Reversibility.** Is the rollback real and rehearsed?
5. **IaC hygiene.** State locking, drift, parameterisation.
6. **Observability of the pipeline itself.** DORA / runtime / failure rate.
7. **Style / consistency.** Last.

## Non-negotiables (auto-block)

- Long-lived cloud credentials in CI.
- Secrets echoed in logs (no masking).
- `docker push :latest` as a deploy.
- `terraform apply -auto-approve` against prod without a reviewed plan.
- Missing rollback plan.
- Unpinned base images or dependencies on the hot path.
- Destructive IaC change (drops, deletes, replaces) with no explicit approval gate.
- Security scanner findings ignored with no policy exemption.
- Environment created or mutated click-ops.

## Output format

1. **Verdict** — Approve / Approve with comments / Request changes / Block.
2. **One-line summary.**
3. **Missing context / assumptions** — if any; otherwise say `None`.
4. **Blockers.**
5. **Non-blockers.**
6. **Nits.**
7. **Risk call-outs** — blast radius observations the author may not have considered.
8. **Praise.**

See `REVIEW_CHECKLIST.md` for the full review matrix.