# scripts AGENTS

Role:
- own helper automation for render, diff, apply, validate, backup, restore, and CI checks
- support Kustomize and operations workflows without replacing declarative ownership

Allowed:
- bash entrypoints
- shell libraries
- CI validation scripts
- backup / restore helper scripts
- wrapper commands around `kubectl kustomize`, `kubectl diff -k`, `kubectl apply -k`

Forbidden:
- scripts becoming the primary source of YAML truth
- large heredoc-generated manifests as the default path
- embedding production secret values
- hiding environment differences in shell conditionals instead of overlays
- giant all-in-one deploy scripts that mix unrelated concerns

Read first:
- `/docs/standards/infra/scripts.md`
- `/docs/standards/infra/kustomize.md`
- `/docs/standards/infra/operations-runbook-upgrade-rollback.md`
- `/docs/standards/infra/backup-restore.md`
- `/docs/standards/infra/k3s-specific.md`

Examples:
- `/docs/examples/infra/scripts.md`
- `/docs/examples/infra/kustomize.md`
- `/docs/examples/infra/backup-restore.md`
- `/docs/examples/infra/operations-runbook-upgrade-rollback.md`
- `/docs/examples/infra/k3s-specific.md`

Rules:
- scripts are helpers, not source of truth
- prefer bash
- non-trivial scripts use functions + `main "$@"`
- use `local` for function-local variables
- ShellCheck must pass
- prefer render -> diff -> apply flow
- destructive actions require explicit opt-in
- environment/context/namespace must be explicit, not implicit