From sdlc-audit
Audit deployment: CI/CD pipelines, IaC configurations, container security, secrets management, supply chain, deployment strategy.
How this skill is triggered — by the user, by Claude, or both
Slash command
/sdlc-audit:deploy-auditThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Аудит как проект собирается, тестируется, деплоится.
Аудит как проект собирается, тестируется, деплоится.
Найти deployment artifacts:
# CI/CD configs
ls -la .github/workflows/ 2>/dev/null
ls -la .gitlab-ci.yml Jenkinsfile bitbucket-pipelines.yml 2>/dev/null
# Containers
ls -la Dockerfile docker-compose*.yml 2>/dev/null
find . -name "Dockerfile*" 2>/dev/null
# IaC
ls -la terraform/ infra/ helm/ k8s/ kubernetes/ 2>/dev/null
find . -name "*.tf" -o -name "Chart.yaml" -o -name "kustomization.yaml" 2>/dev/null
# Deploy scripts
ls -la scripts/deploy* bin/deploy* deploy/ 2>/dev/null
Для каждого pipeline (например .github/workflows/ci.yml):
Quality gates:
Security:
${{ secrets.X }} или secret manager (не hardcoded)permissions: block правильно настроен)pull_request_target где не должно быть (security risk)Efficiency:
Reliability:
Для Dockerfile:
Best practices:
python:3.11.7-slim, не python:latest)USER appuser)--build-arg (visible в docker history).dockerignore correctly excludes secrets, .env files, .gitCommon issues:
COPY . .) без .dockerignoreЕсли есть Terraform/Helm/Kubernetes:
Terraform:
terraform plan в CI?Helm/Kubernetes:
Cross-cutting check across всех deployment artifacts:
Bad patterns (findings):
.env files committed in gitGood patterns:
vault run -- ..., infisical run -- ..., doppler run -- ...)Verification по выбранному менеджеру:
Production deployment:
Environments:
Часто упускается:
В коде искать:
См. severity rules в audit-deploy.md команды.
Findings в docs/audit/<TS>/deploy/findings.json.
Supporting артефакты:
pipeline-review.mdcontainer-security.mdiac-review.mdnpx claudepluginhub shakhovskiya-create/shakhoff-claude-marketplace --plugin sdlc-auditProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.