Agent skill · software engineering · jeremylongshore
castai-ci-integration
Build a fail-closed CI lane for CAST AI configuration without exposing production credentials to untrusted changes. Use when validating CAST AI Terraform, Helm values, workload annotations, or an authorized read-only API smoke test. Trigger with: "test CAST AI in CI", "gate CAST AI changes", "add a CAST AI contract job".
Why this skill is useful
Adds executable scripts for integrating CAST AI cost validation and Terraform checks into CI/CD pipelines, which are not commonly found in public documentation.
What it needs
Requires gh, jq, terraform installed locally. Requires castai account access. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
CAST AI CI Contract Lane Overview Keep pull-request checks local and credential-free. Validate syntax, rendered Kubernetes objects, policy invariants, and destructive change boundaries before allowing a separately protected job to inspect a real CAST AI environment. Prerequisites The workflow, Terraform, Helm values, and workload manifest paths in scope An explicit source of truth for each CAST AI setting Maintainer approval for any protected live probe Instructions Step 1: Map the trust boundary Use Read and Grep to identify fork execution, secret references, Terraform backends, generated plans, Helm values, kubeconfig use, and direct CAST AI calls. Classify each check as offline, protected read-only, or prohibited. Step 2: Build the required offline lane Use Bash(terraform:) for formatting, initialization without applying, validation, and a saved plan. Use Bash(helm:) to lint or template the pinned chart and Bash(kubectl:\) only for client-side schema validation against rendered manifests. Treat unexpected resource deletion, provider replacement, cluster disconnect, automation enablement, or HPA ownership transfer as review-blocking changes. Step 3: Validate CAST AI policy invariants Use Write or Edit to add deterministic checks for approved regions, cluster identifiers, policy names, node-template bounds, workload automation modes, protected namespaces, disruption budgets, and maximum CPU limits. Reject deprecated cluster minimum CPU settings and unreviewed wildcard scope. Step 4: Isolate the optional live lane If live evidence is required, place it in an independent protected-environment job that cannot run for forks. Use a dedicated read-only organization-scoped identity, a pinned CAST AI region, a fixed cluster allowlist, a short timeout, and redacted output. Prefer a documented status read; never enable automation or apply infrastructure from the probe. Step 5: Prove negative behavior Run the workflow with missing and sentinel credentials. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/castai-ci-integration