project-infra/scripts/AGENTS.md

scripts AGENTS

Role:

• own helper automation for render, diff, apply, validate, backup, restore, and CI checks
• support Kustomize and operations workflows without replacing declarative ownership

Allowed:

• bash entrypoints
• shell libraries
• CI validation scripts
• backup / restore helper scripts
• wrapper commands around kubectl kustomize, kubectl diff -k, kubectl apply -k

Forbidden:

• scripts becoming the primary source of YAML truth
• large heredoc-generated manifests as the default path
• embedding production secret values
• hiding environment differences in shell conditionals instead of overlays
• giant all-in-one deploy scripts that mix unrelated concerns

Read first:

• /docs/standards/infra/scripts.md
• /docs/standards/infra/kustomize.md
• /docs/standards/infra/operations-runbook-upgrade-rollback.md
• /docs/standards/infra/backup-restore.md
• /docs/standards/infra/k3s-specific.md

Examples:

• /docs/examples/infra/scripts.md
• /docs/examples/infra/kustomize.md
• /docs/examples/infra/backup-restore.md
• /docs/examples/infra/operations-runbook-upgrade-rollback.md
• /docs/examples/infra/k3s-specific.md

Rules:

• scripts are helpers, not source of truth
• prefer bash
• non-trivial scripts use functions + main "$@"
• use local for function-local variables
• ShellCheck must pass
• prefer render -> diff -> apply flow
• destructive actions require explicit opt-in
• environment/context/namespace must be explicit, not implicit