iac-applylisted

Actually APPLY an Infrastructure-as-Code change — the highest-stakes mutator in nyann; it can mutate real cloud infrastructure. Re-runs the plan, shows it, confirms with the user, then invokes `bin/iac-apply.sh --apply` (adding `--confirm-destroy` only when the user explicitly confirms a destructive change). UNMISTAKABLY opt-in: apply is never the default, destructive applies need a second explicit confirmation. TRIGGER when the user says "terraform apply", "apply the infra change", "deploy this infrastructure", "tofu apply", "cdk deploy", "pulumi up", "helm upgrade", "kubectl apply", "apply the plan", "run the apply now", "yes apply it" (in an IaC context), "ship the infra change", "provision this", "/nyann:apply". DISAMBIGUATION — fire ONLY for IaC apply intent on a detected infra repo. Do NOT trigger on the generic word "apply": NOT "apply this code patch", NOT "apply the suggestion", NOT "apply formatting", NOT "apply a migration" (DB migrations are out of scope), NOT "apply for X". An infra signal is REQ
thettwe/nyann · ★ 6 · DevOps & Infrastructure · score 69

Install: claude install-skill thettwe/nyann

# iac-apply Wraps `bin/iac-apply.sh`. **This is the highest-stakes mutator in nyann** — it can change real cloud infrastructure. Read this end to end before invoking. The gate ladder below is enforced in the script, not just prose; your job is to drive the flags in the right order and never shortcut a confirmation. The script mirrors `bin/undo.sh`'s preview-before-mutate contract: **apply is never the default.** Without `--apply` it previews and exits 0. `--dry-run` always wins over `--apply`. A destructive plan needs a second explicit confirmation on top of `--apply`. The output is a JSON object on stdout (`status: preview|applied|skipped|refused`, plus `tool`, `unit`, `summary`, `destructive`, optional `record_path`, `exit_code`, `message`). ## 0. This skill is opt-in — confirm intent first Never invoke an apply because a plan looked ready. Only proceed when the user has clearly asked to apply/deploy/provision on an infra repo (see DISAMBIGUATION). If they only wanted to see the diff, route to `/nyann:plan`. Confirm there's an infra signal (a tool name, an "infra"/"deploy" intent, or a detected `.iac.tool`) before doing anything. ## 1. Always preview the plan first — show it back Always obtain an **IacPlan** before applying — `iac-apply.sh` computes one internally (or reads `--plan <iacplan.json>` if you already ran `/nyann:plan` and saved it). Either way, run a preview pass first and **show the add/change/destroy summary to the user**: ``` bin/iac-apply.sh --target