Free DevOps templates: three samples from the pack

# Read-only Terraform validate job. Review third-party action versions and pin to SHAs before production.
name: Terraform static validation
on:
  pull_request:
    paths: ['**/*.tf', '.github/workflows/terraform-validate.yml']
permissions:
  contents: read
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: '1.9.8' # Example only; update and approve version
      - name: Format check
        run: terraform fmt -check -recursive
      - name: Initialize without backend
        run: terraform init -backend=false -input=false
      - name: Validate
        run: terraform validate -no-color

# Deny all ingress/egress in demo namespace. Must add DNS and app-specific egress policies.
# Applying as-is can break a workload; review pod labels and CNI enforcement first.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: demo-only
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]

# Incident triage starter runbook

**Purpose:** reduce confusion in the first 15 minutes. Customize escalation contacts, severity definitions and rollback commands before use.

## Intake

1. Capture impact (customer groups, services, regions), first observed time (UTC), and known change window.
2. Assign incident commander, technical lead, scribe and communications owner. Avoid posting secrets in tickets.
3. Validate evidence from two independent signals, such as synthetic availability checks and server-side logs.

## Stabilization

1. Contain risky changes. Pause deployments only when warranted.
2. Consult pre-approved rollback plan; do not improvise stateful database rollbacks.
3. Preserve timestamps, immutable artifacts, traces and change identifiers.

## Communication

- Internal incident updates: severity, impact, mitigation, confidence level, next update time.
- External notifications: approved owner only; respect legal/security notification requirements.

## Exit criteria

- User-facing service recovered and verified; alert noise reduced.
- Follow-up issue owner and due date recorded; root-cause analysis follows with supporting evidence.

# Example only; manually review before apply. No credentials embedded.
terraform {
  required_version = ">= 1.6.0"
  required_providers {
    azurerm = { source = "hashicorp/azurerm", version = "~> 4.0" }
  }

14 more line(s) in the full pack.

# Starter demo, not hardened for production. Pin GitHub actions to SHA digest in real use.
name: Python test
on:
  push:
  pull_request:

12 more line(s) in the full pack.

# Example only. Replace namespace and limits based on workloads and cluster policy.
apiVersion: v1
kind: ResourceQuota
metadata:
  name: starter-quota
  namespace: demo-only
spec:
  hard:

20 more line(s) in the full pack.

# Release and rollback decision template

**Never execute rollback without checking data migrations and dependency compatibility.**

| Check | Evidence / owner |
|---|---|

17 more line(s) in the full pack.

# Cloud cost review: investigation checklist

**Cost concentration ≠ waste.** Recommendations must be based on utilization, SLA, business ownership and contractual commitments.

9 more line(s) in the full pack.

# Azure landing zone review: 20-minute meeting checklist

Use as a discussion aid, not a Microsoft-certified assessment.

- [ ] Tenant hierarchy, management groups and subscription design documented

13 more line(s) in the full pack.

# GitHub Actions OIDC federation review checklist

OIDC can reduce long-lived credentials but is safe only when trust conditions are narrow.

10 more line(s) in the full pack.

# Service SLO design worksheet

| Field | Example, replace before use |
|---|---|

10 more line(s) in the full pack.