New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Apex Iac Common

by jonathan-vella in jonathan-vella/apex

UTILITY SKILL — Shared Bicep/Terraform workflow contracts: planning, codegen cadence, handoffs, deployment strategies and bounded recovery.

MITAuto-check passedDevOps & Cloud

Install Apex Iac Common

skills CLI
$ npx skills add jonathan-vella/apex --skill apex-iac-common -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install jonathan-vella/apex apex-iac-common --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/jonathan-vella/apex.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/skills/apex-iac-common .claude/skills/apex-iac-common && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
apex-iac-common
GitHub stars
217
Token cost
~2.3k tokens
SKILL.md length
762 words
Files
21 (incl. references)
Skills in repo
39
Repo updated
First seen
Licence
MIT

At a glance

UTILITY SKILL — Shared Bicep/Terraform workflow contracts: planning, codegen cadence, handoffs, deployment strategies and bounded recovery.

  • Works in 7 steps: Preflight — use APEX-mode… → Set environment — azd env set… → Preview — azd provision --preview… → …
  • : language-specific modules (apex-azure-bicep-patterns / apex-terraform-patterns)
  • SKILL.md covers Rules, Steps, Deployment Strategies and Reference Index, plus 2 more sections
  • Calls terraform

What it does

Apex Iac Common is an agent skill from jonathan-vella/apex. UTILITY SKILL — Shared Bicep/Terraform workflow contracts: planning, codegen cadence, handoffs, deployment strategies and bounded recovery. WHEN: "shared IaC workflow", "phased deployment", "circuit breaker", "deploy strategy", "deploy issue", "shared IaC pattern". DO NOT USE FOR: language-specific modules (apex-azure-bicep-patterns / apex-terraform-patterns) or standalone preflight (apex-azure-validate).

Its SKILL.md is about 2.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 21 other files, including reference files (for example `references/avm-module-index.md`, `references/avm-version-freeze-gate.md` and `references/azd-vs-deploy-guide.md`).

It sits in DevOps & Cloud, covering Infrastructure as code. It works with Bicep, Microsoft Azure and Terraform. The repository describes itself as: APEX turns Azure platform engineering requirements into verified, deploy-ready IaC — powered by GitHub Copilot agents, real-time pricing, and built-in compliance. The licence is MIT.

When your agent uses it

  • : language-specific modules (apex-azure-bicep-patterns / apex-terraform-patterns)
  • Standalone preflight (apex-azure-validate)

Example prompts

  • “shared IaC workflow”
  • “phased deployment”
  • “circuit breaker”
  • “/apex-iac-common”

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Preflight — use APEX-mode apex-azure-validate (auth, governance, handoff/readiness);
  2. Set environment — azd env set AZURE_SUBSCRIPTION_ID/RESOURCE_GROUP/LOCATION + verify via azd env get-values
  3. Preview — azd provision --preview (Bicep) or terraform plan (Terraform); user reviews destructive operations
  4. Approve gate — user explicitly approves the preview before any apply
  5. Apply — azd provision / azd up (Bicep) or terraform apply (Terraform); for high-risk projects, deploy in phases (Foundation → Security →…
  6. Circuit-break on failure — stop on policy/governance/budget violations; surface diagnostics to user
  7. Hand off to 08-As-Built for documentation

What it can do on your machine

Read from SKILL.md and the folder at commit b8e5908. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • terraform

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Apex Iac Common loads about 2.3k tokens when it runs, and up to ~44k if it reads all its reference files. Until then it costs about 107 tokens; SKILL.md has 762 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~107
When it runs · the whole SKILL.md, loaded when a task matches
~2.3k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~44k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from jonathan-vella/apex at commit b8e5908, republished under its MIT licence (© jonathan-vella). 762 words, ~2,327 tokens.

Download SKILL.mdSave it as .claude/skills/apex-iac-common/SKILL.md (or your agent's skills folder). This skill also uses 20 other files; get the full folder from GitHub.
name
apex-iac-common
description
**UTILITY SKILL** — Shared Bicep/Terraform workflow contracts: planning, codegen cadence, handoffs, deployment strategies and bounded recovery. WHEN: "shared IaC workflow", "phased deployment", "circuit breaker", "deploy strategy", "deploy issue", "shared IaC pattern". DO NOT USE FOR: language-specific modules (apex-azure-bicep-patterns / apex-terraform-patterns) or standalone preflight (apex-azure-validate).
user-invocable
false
disable-model-invocation
false

IaC Common Skill

Shared planning, codegen and deployment contracts used by Bicep and Terraform agents and their explicitly authorized leaf workers.

Preflight validation (CLI auth, governance mapping, stop rules, known issues) has moved to the apex-azure-validate skill. See apex-azure-validate/references/infraops-preflight.md.

Rules

  • Preflight first — 07b/07t use the APEX branch of apex-azure-validate and the shared deploy readiness contract; generic applications use their prepared plan and recorded proof. Preflight never starts generic preparation for APEX.
  • azd by default — use azd provision / azd up for all new projects. The legacy deploy.ps1 path is deprecated; full decision matrix in references/azd-vs-deploy-guide.md.
  • Phased deployment for high-risk changes — split into Foundation → Security → Data → Compute → Edge with user approval at each gate
  • Circuit breaker — stop deployment automatically when policy violations, governance failures, or budget breaches are detected; surface to user before retrying
  • Set environment values before --no-prompt — AZURE_SUBSCRIPTION_ID, AZURE_RESOURCE_GROUP, AZURE_ENV_NAME, AZURE_LOCATION must all be present (azd env get-values)
  • Use azd env new {project}-{env} to avoid environment-name collisions across projects
  • Out of scope: preflight (use apex-azure-validate); code generation (use apex-azure-bicep-patterns or apex-terraform-patterns)

Steps

Standard deploy flow used by 07b-Bicep Deploy and 07t-Terraform Deploy:

  1. Preflight — use APEX-mode apex-azure-validate (auth, governance, handoff/readiness); return results and stop for validation-only
  2. Set environment — azd env set AZURE_SUBSCRIPTION_ID/RESOURCE_GROUP/LOCATION + verify via azd env get-values
  3. Preview — azd provision --preview (Bicep) or terraform plan (Terraform); user reviews destructive operations
  4. Approve gate — user explicitly approves the preview before any apply
  5. Apply — azd provision / azd up (Bicep) or terraform apply (Terraform); for high-risk projects, deploy in phases (Foundation → Security → Data → Compute → Edge)
  6. Circuit-break on failure — stop on policy/governance/budget violations; surface diagnostics to user
  7. Hand off to 08-As-Built for documentation

Deployment Strategies

Default: use azd for every project. Each project is a self-contained azd project (azure.yaml + .azure/ inside infra/{iac}/{project}/). Phased deployment is now done via azd hooks (preprovision / postprovision).

Full procedure (azd up / azd provision --preview, environment preflight checklist for --no-prompt deploys, deprecated phased table, single-deployment fallback, and the legacy deploy.ps1 decision matrix) lives in references/deployment-strategies.md.

Single-deployment exception: for projects with < 5 resources in dev/test, a single azd deployment is acceptable. All deploys still require explicit user approval.

Reference Index

ReferenceLocation
Deployment strategiesreferences/deployment-strategies.md
azd vs deploy.ps1 guidereferences/azd-vs-deploy-guide.md
AVM module indexreferences/avm-module-index.md (canonical CSV + JSON list of AVM modules in .github/data/)
AVM version freeze gatereferences/avm-version-freeze-gate.md (Phase 4.4 gate before plan_status=APPROVED)
Codegen shared workflowreferences/codegen-shared-workflow.md (Phase 2 output cadence loaded by 06b/06t CodeGen agents)
Codegen file-orderreferences/codegen-file-order.md (per-tool file emission order loaded by 06b/06t CodeGen agents)
Codegen DO / DON'Treferences/codegen-do-dont.md (shared DO/DON'T bullets between 06b + 06t; tool-specific bullets stay in each agent body)
Preflight policy checksreferences/preflight-policy-checks.md (deploy-agent jq snippets, skip-validation shortcut, L3 precheck routing matrix, deprecation scan regex)
Azure Resource Graph primerreferences/azure-resource-graph-primer.md (canonical shared head used by apex-azure-compliance / apex-azure-cost-optimization / apex-azure-diagnostics resource-graph references)
Preflight validationapex-azure-validate/references/infraops-preflight.md
CLI auth validation procedureapex-azure-defaults/references/azure-cli-auth-validation.md
Policy effect decision treeapex-azure-defaults/references/policy-effect-decision-tree.md
IaC policy compliance.github/instructions/iac-bicep-best-practices.instructions.md / .github/instructions/iac-terraform-best-practices.instructions.md
Bootstrap backend templatesapex-terraform-patterns/references/bootstrap-backend-template.md
Deploy script templatesapex-terraform-patterns/references/deploy-script-template.md
Circuit breakerreferences/circuit-breaker.md
Show full SKILL.md (273 more words)Show less

Circuit Breaker

Deploy agents MUST read references/circuit-breaker.md before starting any deployment. It defines:

  • Failure taxonomy: 6 categories (build, validation, deployment, empty, timeout, auth)
  • Anomaly patterns: detection thresholds for repetitive failures
  • Stopping rule: 3 consecutive same-type failures → halt + escalate
  • Escalation protocol: write to session state, notify user, wait for guidance

Bounded retry

Unless a stricter operation-specific cap applies, any retry loop in 04g-governance, 07b-bicep-deploy, 07t-terraform-deploy, or the deploy-time subagents (bicep-whatif, terraform-plan, policy-precheck, cost-estimate) is capped at 3 attempts. On the third failure the agent escalates to the user with these three fixed options (and no others):

OptionWhen to choose
proceed-with-substitutePropose a substitute for explicit approval and owning-agent reconciliation; never apply it automatically.
change-regionPropose a region change for explicit approval; refresh affected policy, capacity, pricing and plan evidence.
abortNone of the above is safe — return control to the user.

Neither choice bypasses a required step, security rule, unresolved blocker, frozen plan, SKU manifest, or review. Route revisions to the owning agent, regenerate affected evidence, rerun required validation/reviews and obtain final evidence-bound approval before retrying. No skip-step or unlimited reset option. Missing/empty reviewer output has the stricter one identical-input retry cap. Use the same options across these loops. The challenger-review-subagent checklist enforces "retry loop bounded ≤3 with named escalation options"; unbounded loops are flagged as HIGH.

Implementation hooks:

  • Loop counter lives in the agent body, not in shared infrastructure (counts reset between human approvals).
  • Record the substitute/region change as an apex-recall decide entry before retrying so the next session can trace the path.
  • Combine with the circuit breaker: a 3-failure retry that escalates with abort ALSO trips the circuit breaker's escalation protocol.

© jonathan-vella, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 20 other files (references) in .github/skills/apex-iac-common of jonathan-vella/apex.

  • SKILL.md
  • references/avm-module-index.md
  • references/avm-version-freeze-gate.md
  • references/azd-vs-deploy-guide.md
  • references/azure-resource-graph-primer.md
  • references/circuit-breaker.md
  • references/codegen-do-dont.md
  • references/codegen-file-order.md
  • references/codegen-shared-workflow.md
  • references/contract-emission-and-handoff.md
  • references/deploy-shared-workflow.md
  • references/deploy-validation-checklist.md
  • references/deployment-strategies.md
  • references/governance-drift-routing.md
  • references/iac-planner-approval-gate.md
  • references/known-deploy-issues.md
  • references/placeholder-scan-protocol.md
  • references/plan-consistency-checks.md
  • references/policy-precheck-contract.md
  • references/preflight-policy-checks.md
  • … and 1 more

Open the folder on GitHubat commit b8e5908

Compare with similar skills

Apex Iac Common next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Apex Iac Common compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Apex Iac Common this skilljonathan-vella/apex217—~2.3kAutomated safety check: PassMIT
Iac Securityhardw00t/ai-security-arsenal105—~2.4kAutomated safety check: PassNone
Azure Deploymicrosoft/GitHub-Copilot-for-Azure2551 repos~1.6kAutomated safety check: PassMIT
Azure Preparemicrosoft/GitHub-Copilot-for-Azure2551 repos~3.2kAutomated safety check: PassMIT
Azure Validatemicrosoft/GitHub-Copilot-for-Azure2551 repos~880Automated safety check: PassMIT
Azure To AWSaws/agent-toolkit-for-aws2.8k—~5.5kAutomated safety check: PassApache-2.0

Similar skills

  • Iac Security

    hardw00t/ai-security-arsenal

    Infrastructure-as-Code security scanning router for Terraform, CloudFormation, Kubernetes manifests, Helm, ARM/Bicep.

    105 GitHub stars~2.4k tokensUpdated 5 mo ago
    DevOps & CloudAuto-check passed

  • Azure Deploy

    microsoft/GitHub-Copilot-for-Azure

    Official

    Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files.

    255 GitHub starsUsed in 1 repo~1.6k tokens
    DevOps & CloudAuto-check passed

  • Azure Prepare

    microsoft/GitHub-Copilot-for-Azure

    Official

    Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow.

    255 GitHub starsUsed in 1 repo~3.2k tokens
    DevOps & CloudAuto-check passed

  • Azure Validate

    microsoft/GitHub-Copilot-for-Azure

    Official

    Pre-deployment validation for Azure readiness. An agent skill from microsoft/GitHub-Copilot-for-Azure.

    255 GitHub starsUsed in 1 repo~880 tokens
    DevOps & CloudAuto-check passed

  • Azure To AWS

    aws/agent-toolkit-for-aws

    Official

    Migrate workloads from Microsoft Azure to AWS. An agent skill from aws/agent-toolkit-for-aws.

    2.8k GitHub stars~5.5k tokensUpdated yesterday
    DevOps & CloudAuto-check passed

  • Azure Copilot

    MicrosoftDocs/Agent-Skills

    Official

    Expert knowledge for Azure Copilot development including troubleshooting, decision making, architecture & design patterns, security, configuration, and integrations & coding patterns.

    776 GitHub stars~1.4k tokensUpdated 5 days ago
    DevOps & CloudAuto-check passed

More from jonathan-vella/apex

All 39 skills in this repo

  • Apex Azure Diagnostics

    jonathan-vella/apex

    WORKFLOW SKILL — Debug Azure production issues: Container Apps, Functions, App Service, AKS, VMs and messaging, with KQL log analysis.

    217 GitHub stars~2.1k tokensUpdated today
    Auto-check passed

  • Apex Azure Governance Discovery

    jonathan-vella/apex

    ANALYSIS SKILL — Azure Policy discovery: effective assignments (incl.

    217 GitHub stars~2.1k tokensUpdated today
    Auto-check passed

  • Apex Context Management

    jonathan-vella/apex

    UTILITY SKILL — Two-mode context-window management. An agent skill from jonathan-vella/apex.

    217 GitHub stars~1.8k tokensUpdated today
    Auto-check passed

  • Apex Python Diagrams

    jonathan-vella/apex

    UTILITY SKILL — Python diagram generation for Azure architectures, WAF/cost/compliance charts, ERDs, swimlanes, timelines, and wireframes.

    217 GitHub stars~2k tokensUpdated today
    Auto-check passed

  • Apex Terraform Search Import

    jonathan-vella/apex

    WORKFLOW SKILL — Manual-only discovery and import of existing Azure resources into Terraform management.

    217 GitHub stars~1.4k tokensUpdated today
    Auto-check passed

  • Apex Vendor Prompting

    jonathan-vella/apex

    ANALYSIS SKILL — Manual-only audit of Anthropic Claude Opus 5.5 / Sonnet 5.5 and OpenAI GPT-6 / GPT-5.6 prompting guidance and APEX conventions.

    217 GitHub stars~2.7k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Apex Iac Common

What does Apex Iac Common do?

UTILITY SKILL — Shared Bicep/Terraform workflow contracts: planning, codegen cadence, handoffs, deployment strategies and bounded recovery. Apex Iac Common is an agent skill from jonathan-vella/apex. UTILITY SKILL — Shared Bicep/Terraform workflow contracts: planning, codegen cadence, handoffs, deployment strategies and bounded recovery.

When should I use Apex Iac Common?

Apex Iac Common fits situations like: : language-specific modules (apex-azure-bicep-patterns / apex-terraform-patterns); standalone preflight (apex-azure-validate).

How do I install Apex Iac Common in Claude Code?

Run `npx skills add jonathan-vella/apex --skill apex-iac-common -a claude-code`. Or copy the skill folder (.github/skills/apex-iac-common in jonathan-vella/apex) into .claude/skills/apex-iac-common in your project. Claude Code loads it when a task matches its description.

How do I install Apex Iac Common in Codex?

Run `npx skills add jonathan-vella/apex --skill apex-iac-common -a codex`. Or copy the skill folder (.github/skills/apex-iac-common in jonathan-vella/apex) into .agents/skills/apex-iac-common in your project. Codex loads it when a task matches its description.

Can I use Apex Iac Common in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jonathan-vella/apex --skill apex-iac-common -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/apex-iac-common, .gemini/skills/apex-iac-common, .github/skills/apex-iac-common and .opencode/skills/apex-iac-common in your project.

What does Apex Iac Common need to run?

Going by SKILL.md and its folder, Apex Iac Common needs the command-line tools its instructions call (terraform).

Does Apex Iac Common access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Apex Iac Common safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Apex Iac Common use?

Apex Iac Common is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Apex Iac Common use?

About 2.3k tokens (SKILL.md is roughly 9.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 42k tokens, read only when the agent opens those files.

What are the alternatives to Apex Iac Common?

Skills that share tags, products or a category with Apex Iac Common: Iac Security (hardw00t/ai-security-arsenal, 105 stars), Azure Deploy (microsoft/GitHub-Copilot-for-Azure, 255 stars), Azure Prepare (microsoft/GitHub-Copilot-for-Azure, 255 stars) and Azure Validate (microsoft/GitHub-Copilot-for-Azure, 255 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Apex Iac Common?

jonathan-vella (a GitHub user) maintains it in jonathan-vella/apex, which has 217 GitHub stars. The repository holds 39 skills in this directory. The repository was last updated on October 10, 2026.

Source: jonathan-vella/apex on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.