K8S Profile

/k8s-profile — detect a repo's build profile

Target: $ARGUMENTS (a repo directory; a sibling of the workspace root)

Workspace state

cd "${CLAUDE_PROJECT_DIR:-$PWD}" && for d in */; do [ -d "$d.git" ] && echo "  ${d%/}"; done; echo "(directories above are git clones in the workspace root)"

Already-cached profiles:

ls -1 "${CLAUDE_PLUGIN_DATA}"/profiles/*.json 2>/dev/null | xargs -n1 basename 2>/dev/null || echo "(none yet)"

Run it

${CLAUDE_PLUGIN_ROOT}/scripts/detect-profile.sh <repo-dir> --write --data "${CLAUDE_PLUGIN_DATA}"

• --write caches to ${CLAUDE_PLUGIN_DATA}/profiles/<repo>.json — the cross-run cache, which survives plugin updates.
• Always pass --data "${CLAUDE_PLUGIN_DATA}". That variable is substituted into this skill's text, but it is not present in the environment of a plain Bash tool call, so the script cannot find it itself.
• The cache is keyed on a hash of the inputs it read (Makefile, go.mod, .go-version, golangci config, .prow.yaml, OWNERS, CONTRIBUTING, and the hack/ and .github/workflows/ listings). Re-running is a no-op until one of those changes.
• --force regenerates regardless.

What it derives, and from what

Never hard-code a repo's commands. Detection order:

1. Makefile — real targets, parsed from rule lines. It handles multi-target rules (check test: is how kubernetes defines test), and skips .PHONY, variables, and pattern rules.
2. hack/ — verify-*.sh, update-*.sh, install-etcd.sh, local-up-cluster.sh, ginkgo-e2e.sh, update-codegen.sh.
3. go.mod / .go-version / golangci config — module path, Go version.
4. .github/workflows/, .prow.yaml, OWNERS, OWNERS_ALIASES, SECURITY_CONTACTS — CI system, reviewers, SIG label.
5. Test layout — test/integration, test/e2e, test/e2e_node, pkg, cmd, staging, and the PR/issue templates.
6. Frameworks — envtest, kind, ginkgo, and which assertion library the repo's own _test.go files actually use most. The fix must use that one.

Hazards

The profile records hazards[] for targets that are unsafe under this workspace's rules, and routes the gate commands around them.

Worked example: in gwctl, make build, make test, and make verify all depend on a deps target that runs go mod tidy && go mod vendor. Running them rewrites go.mod/go.sum/vendor/, which guard-deps.sh blocks. The detector notices, flags all three, and emits the plain go build ./... / go test -race -count=1 ./... equivalents instead.

Check hazards before trusting any make invocation in a repo you have not profiled.

Low confidence

When the signals are too thin, the profile records "confidence": "low" (or "medium") with a confidence_reason.

Do not guess past it. Read the reason, then ask the user one targeted question — the specific command you could not derive — rather than inventing a command that will fail ten minutes into a gate.

Worked example: kube-openapi has no Makefile at all, so it comes back medium with "no Makefile: commands fall back to the plain go toolchain". That fallback is correct there, and the note tells you it was a fallback rather than a detected target.

Reading the result

jq '{confidence, confidence_reason, commands, requires, hazards, assertion_library}' \
  ${CLAUDE_PLUGIN_DATA}/profiles/<repo>.json

Fields the rest of the system relies on: commands.* (gate commands), requires.etcd|kind|envtest, assertion_library, pr_template, owners_reviewers, sig_label, uses_prow, sensitive_paths, gate_runtime_estimate_s (so the verifier can warn before a 40-minute run), and gate_sets_by_change_class.