What problem does it solve? Repositories often declare that infrastructure code must be statically analysed, yet the analysers are unpinned, wired inconsistently between pre-commit and CI, or not enforced as required checks. This Skill deploys the IAC-001 control from a controls.yaml register so that checkov and tflint run identically at commit time and in CI, with every value derived from the register rather than chosen ad hoc. ## Core Features & Use Cases - Register-driven deployment: Reads analysers, arguments, tool invocation, and suppression rules from controls.yaml so no tool or version is hard-coded in the skill. - Dual-locus wiring: Writes a stamped pre-commit hook and, only when no full audit exists, a CI step that runs register-check against IAC-001. - Self-verification: Runs register-check run --control IAC-001 after deployment and reports the verdict as given, distinguishing failed deployments from real Terraform findings. - Use Case: A team adopting the ee-standard register in a repository containing Terraform invokes the skill to wire checkov and tflint into .pre-commit-config.yaml and their gating workflow, then receives an honest report including UNCLASSIFIED verdicts when analysers are not yet pinned. ## Quick Start Ask the AI to deploy gate-iac into the current repository using its controls.yaml register and report the verification verdict.
