apply-and-destroy

How to safely apply and destroy this platform's OpenTofu + Terragrunt infrastructure — the deployment-ordering DAG, the exact (redesigned v1.x) run --all commands, and the destroy invocation with its dangerous flags. Use when applying a unit or a whole environment, tearing down/rebuilding, or reasoning about deployment order (what must come before what). Prefer platctl for full bootstrap/teardown. CRITICAL: get the destroy command and the private-EKS endpoint handling right. Consult this ANY time you run a `terragrunt plan`/`apply` (or `tofu` equivalent) on this repo — it covers running them so you can actually READ the result: capture output to a file instead of piping the only copy through a lossy grep, the `AWS_PROFILE=management` requirement (plan/apply assume PlatformDeployer; validate doesn't), and the "don't start a second run on the same unit / state-lock held by multiple users" trap with long backgrounded applies. Also covers whether a change is already applied by CI on merge (the `gitops/teams/**` and `gitops/products/**` apply-on-merge workflows) versus needing a manual operator apply — check that BEFORE handing someone a manual apply. NOT for authoring a unit (terragrunt-units) or module (terraform-style).

Claude Skills are markdown + scripts loaded into Claude Code; scanned with the same pipeline.

Source:

github.com/asanexample/platform

Provenance:

Found by crawling (provenance, not a security rating)

We found this by crawling public sources and nobody has attested to it. That is how most of the registry gets here, and it is not a mark against the artifact — it only means no authenticated act of publication is on record. An artifact can be the vendor's own and still appear here.

242 critical findings reported by agent-audit-kit, 1 of them in the installed artifact. The composite score alone does not reflect this — read the per-scanner reports below.