feat: add s-fc3 skill and ignore .codegraph - #163
Conversation
- Bundle s-fc3 skill under .agents/skills/s-fc3 for project-relative install - Add .codegraph/ to .gitignore - Fix docs: cross-platform date examples, FC_DOCKER_VERSION 3.1.0, logs --match value, remove certConfig from HTTP domain example - Fix release-ops: alias --vw flag, scaling max-instances removal, horizontal scaling minInstances/maxInstances field names
📝 WalkthroughWalkthrough新增阿里云函数计算 FC3 Agent Skill，包含安装、配置、部署、调用、日志、运维、触发器、自定义域名、权限和故障排查文档，并启用隐式调用配置。 ChangesFC3 Agent Skill
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
rsonghuster
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 12
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/s-fc3/agents/openai.yaml:
- Around line 4-7: 在 s-fc3 的 agents/openai.yaml 中为 allow_implicit_invocation:
true 增加宿主 Agent 权限约束：隐式调用仅可检查、诊断和生成建议，不得直接执行部署、删除、资源变更或远程命令；涉及 s deploy、s remove
-y、s instance exec 等副作用操作时，必须先获取用户显式确认后再执行。
In @.agents/skills/s-fc3/README.md:
- Line 24: 更新 README 中执行 fc3 list 的命令，在 cn-hangzhou 区域参数中加入 --prefix test，让 CLI
直接返回 test* 函数；保留 JSON、静默输出及后续按服务名、数量、运行时和创建时间汇总的逻辑不变。
In @.agents/skills/s-fc3/references/domain.md:
- Around line 53-57: Update the domainName: auto section to state that temporary
*.devsapp.net domains are reclaimed 30 days after issuance, or remove the fixed
retention-period statement while preserving the learning/testing-only guidance.
- Line 131: Update the HTTPS/dual-protocol configuration guidance to require
certificates under certConfig, using certConfig.certId or the PEM fields within
certConfig; remove the top-level certId alternative.
- Around line 48-51: Update the PEM source guidance near the
certId/certificate/privateKey options to avoid presenting public HTTP/HTTPS URLs
as safe sources for privateKey material; qualify URL support with HTTPS and
trusted access controls, or state that privateKey must use an access-controlled
source while preserving supported public-URL behavior for non-sensitive
certificate data.
In @.agents/skills/s-fc3/references/release-ops.md:
- Around line 34-40: Update the examples in release-ops.md to show their
deployment field wrappers before publication: place the scheduled array under
the appropriate scheduling field and place metricType, metricTarget, min/max
capacity settings under the field that supports them. For provisionConfig, use
minCapacity and maxCapacity instead of minInstances and maxInstances, ensuring
each example is valid standalone FC3 YAML and copy-pastable into scalingConfig
or provisionConfig.
In @.agents/skills/s-fc3/references/triggers-and-async.md:
- Around line 43-49: Update the asyncInvokeConfig schema example to remove
statefulInvocation and use asyncTask: true only when task mode is required;
retain the existing retry and event-age settings.
In @.agents/skills/s-fc3/references/troubleshooting.md:
- Line 7: Update the AccessDenied/403 guidance in the troubleshooting table to
recommend least-privilege RAM permissions: document the minimum FC actions and
resource ARNs required for the relevant deployment operation, and scope
ram:PassRole to the exact execution-role ARN rather than only the
fc.aliyuncs.com condition. Retain AliyunFCFullAccess only as a clearly warned
temporary troubleshooting fallback.
In @.agents/skills/s-fc3/SKILL.md:
- Around line 247-263: 更新多环境（vars）示例，移除无效的 `s deploy --var env=staging` 用法；保留
`${vars.env}` 配置引用，并改为使用 `s env --env staging` 或 `s deploy --env staging`
作为环境切换命令。
- Line 320: 更新 FC3 生产环境自定义策略建议，明确基础函数 ARN 仅适用于函数级操作，并为 publish/delete
version、add alias 及相关别名操作补充对应的 versions/*、versions/{version}、aliases/* 或
aliases/{alias} 子资源 ARN；按操作拆分权限示例，确保合法的版本和别名操作不会被策略拒绝。
- Around line 265-279: 更新“自定义容器”示例中的部署命令：首次构建后将 s deploy --skip-push 改为 s
deploy，确保本地构建镜像被推送；仅在后续已确认相同镜像已推送到 customContainerConfig.image 指定地址时说明可使用
--skip-push。
- Line 141: 更新 s logs 的时间参数说明，移除“不能使用 Z”的禁止性表述，明确 fc3 logs 支持 UTC 时间字符串、Unix
时间戳及带标准时区偏移的 ISO-8601 时间（如 +08:00）。
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1bd14b5b-fd66-4516-bcfe-7b12b97b3544
📒 Files selected for processing (9)
.agents/skills/s-fc3/README.md.agents/skills/s-fc3/SKILL.md.agents/skills/s-fc3/agents/openai.yaml.agents/skills/s-fc3/references/domain.md.agents/skills/s-fc3/references/fc-endpoints.md.agents/skills/s-fc3/references/release-ops.md.agents/skills/s-fc3/references/triggers-and-async.md.agents/skills/s-fc3/references/troubleshooting.md.gitignore
| default_prompt: "Use $s-fc3 to help me inspect my s.yaml and safely deploy, debug, or troubleshoot an Alibaba Cloud FC3 function." | ||
|
|
||
| policy: | ||
| allow_implicit_invocation: true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n -C 3 \
'allow_implicit_invocation|implicit.*invocation|confirm|approval|deploy|remove|instance exec' \
.agentsRepository: devsapp/fc3
Length of output: 13381
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf 'Relevant agent Skill files:\n'
find .agents/skills/s-fc3 -type f -maxdepth 2 | sort
printf '\nSkill outline:\n'
ast-grep outline .agents/skills/s-fc3/SKILL.md --view compact || true
printf '\nPrompt/security-related passages:\n'
rg -n -C 4 '显式确认|用户确认|confirm|approval|部署|删除|执行命令|instance exec|allow_implicit_invocation|允许|自动|safe|safely|确认' .agents/skills/s-fc3 .agents || trueRepository: devsapp/fc3
Length of output: 32923
为隐式技能调用增加显式确认约束。
当前 .agents/skills/s-fc3 没有定义宿主 Agent 的权限边界，技能文档会执行 s deploy、s remove -y、s instance exec 等副作用命令。在启用 allow_implicit_invocation: true 的前提下，应新增约束：隐式调用不得直接执行部署、删除、资源变更或远程命令；这些命令必须由用户显式确认后再运行。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/s-fc3/agents/openai.yaml around lines 4 - 7, 在 s-fc3 的
agents/openai.yaml 中为 allow_implicit_invocation: true 增加宿主 Agent
权限约束：隐式调用仅可检查、诊断和生成建议，不得直接执行部署、删除、资源变更或远程命令；涉及 s deploy、s remove -y、s instance
exec 等副作用操作时，必须先获取用户显式确认后再执行。
| ❯ 帮我查看下阿里云杭州 test 为前缀的函数有哪些 | ||
| ``` | ||
|
|
||
| Agent 自动执行 `s cli fc3 list --region cn-hangzhou -o json --silent`，筛选出所有 `test*` 函数，分类汇总服务名、函数数量、运行时和创建时间。 |
There was a problem hiding this comment.
🚀 Performance & Scalability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
curl -fsSL \
'https://raw.githubusercontent.com/devsapp/fc3/master/src/subCommands/list/index.ts' |
rg -n 'prefix|listFunctions'Repository: devsapp/fc3
Length of output: 410
🏁 Script executed:
#!/usr/bin/envbash
set -euo pipefail
printf 'README excerpt:\n'
sed -n '18,28p' .agents/skills/s-fc3/README.md 2>/dev/null || true
printf '\nfc3 list source excerpt:\n'
url='https://raw.githubusercontent.com/devsapp/fc3/master/src/subCommands/list/index.ts'
python3 - <<'PY'
import urllib.request, re
with urllib.request.urlopen('https://raw.githubusercontent.com/devsapp/fc3/master/src/subCommands/list/index.ts') as r:
text = r.read().decode()
for i, line in enumerate(text.splitlines(), 1):
if i <= 80:
print(f'{i:4d}: {line}')
PY
printf '\nSearch for listFunctions implementation references/FC SDK typings:\n'
git ls-files | rg -i 'fc3|sdk|listFunctions' | head -100Repository: devsapp/fc3
Length of output: 2648
🌐 Web query:
github devsapp fc3 src/subCommands/list/index.ts --prefix filter listFunctions
💡 Result:
The file src/subCommands/list/index.ts in the devsapp/fc3 repository is part of the Serverless Devs component for Alibaba Cloud Function Compute 3.0 [1][2]. This component uses a subcommand-based architecture where src/subCommands/list/index.ts handles the business logic for listing resources (such as functions, services, or triggers) within the CLI [1][3]. Regarding your query about --prefix and listFunctions: 1. CLI Command Structure: The fc3 component is designed to be used via the Serverless Devs (s) CLI [4]. While the source code defines the handling of these commands [3], user-level interaction is typically performed using standard CLI commands like s list or specific API calls via s cli fc-api [5][6]. 2. --prefix Argument: In the context of Alibaba Cloud FC APIs used by these components, a --prefix parameter is often supported in listing operations to filter results by name (e.g., listing functions that start with a specific string) [5]. 3. listFunctions: The term listFunctions typically refers to an underlying API operation (ListFunctions) or a specific CLI subcommand action [5]. If you are trying to list functions with a prefix filter, you would generally use the CLI command syntax rather than referencing the internal source file path directly. For example, if using the fc-api tool (which often mirrors these functions), the command structure would look like: s cli fc-api listFunctions --prefix The source file src/subCommands/list/index.ts acts as the entry point for the list command within the fc3 component [3], routing these CLI requests to the appropriate cloud provider API methods [1][3]. You do not need to call the source file directly; the CLI handles the routing automatically based on the arguments provided [3][2].
Citations:
- 1: https://github.com/devsapp/fc3
- 2: https://github.com/devsapp/fc3/blob/master/CLAUDE.md
- 3: https://github.com/devsapp/fc3/blob/master/src/index.ts
- 4: https://www.alibabacloud.com/help/en/functioncompute/fc/developer-reference/serverless-devs-1/
- 5: https://github.com/devsapp/fc-api/blob/main/commands/listTriggers.md
- 6: https://github.com/devsapp/fc3/blob/master/publish.yaml
🌐 Web query:
devsapp fc3 listFunctionsPage prefix implementation
💡 Result:
In the context of the devsapp/fc3 component, there is no direct command named listFunctionsPage. The fc3 component is designed for full lifecycle management of Alibaba Cloud Function Compute 3.0 resources [1][2]. Function listing operations in Function Compute are typically handled by the Alibaba Cloud API [3], which the Serverless Devs tooling facilitates. Specifically: 1. API Level: The underlying ListFunctions API, which the tool utilizes, supports a prefix parameter to filter functions by name [3]. 2. CLI Usage: While fc3 focuses on resource management (deploy, build, sync, etc.) [1][4], the general devsapp/fc-api tool (which provides low-level API access) includes commands like listTriggers that support --prefix [5]. For broader API operations, the fc component provides an api command, which accepts a --query parameter [6] that can be used to pass a JSON object containing the prefix [6]. If you are looking to list functions with a prefix using Serverless Devs, you should use the generic api call command provided by the underlying fc (or similar) infrastructure [6] or query the API directly if you are writing custom code within the fc3 component's framework [7]. The fc3 component itself exposes subcommands through index.ts [8] and focuses on higher-level lifecycle management rather than raw API pagination methods [1][2].
Citations:
- 1: https://github.com/devsapp/fc3
- 2: https://github.com/devsapp/fc3/blob/master/CLAUDE.md
- 3: https://www.alibabacloud.com/help/en/functioncompute/fc/developer-reference/api-fc-2023-03-30-listfunctions
- 4: https://github.com/devsapp/fc3/blob/master/publish.yaml
- 5: https://github.com/devsapp/fc-api/blob/main/commands/listTriggers.md
- 6: https://github.com/devsapp/fc/blob/main/docs/en/command/api.md
- 7: https://github.com/devsapp/fc3/blob/master/src/subCommands/sync/index.ts
- 8: https://github.com/devsapp/fc3/blob/master/src/index.ts
把前缀传给 fc3 list。
当前命令会先获取 cn-hangzhou 下所有函数，再在 Agent 端筛选 test*。fc3 list 接受 --prefix；改为 --prefix test 可以让 CLI/API 直接返回匹配范围的函数列表，减少不必要的遍历和无关数据处理。
建议修改
- Agent 自动执行 `s cli fc3 list --region cn-hangzhou -o json --silent`
+ Agent 自动执行 `s cli fc3 list --region cn-hangzhou --prefix test -o json --silent`📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| Agent 自动执行 `s cli fc3 list --region cn-hangzhou -o json --silent`，筛选出所有 `test*` 函数，分类汇总服务名、函数数量、运行时和创建时间。 | |
| Agent 自动执行 `s cli fc3 list --region cn-hangzhou --prefix test -o json --silent`，筛选出所有 `test*` 函数，分类汇总服务名、函数数量、运行时和创建时间。 |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/s-fc3/README.md at line 24, 更新 README 中执行 fc3 list 的命令，在
cn-hangzhou 区域参数中加入 --prefix test，让 CLI 直接返回 test* 函数；保留
JSON、静默输出及后续按服务名、数量、运行时和创建时间汇总的逻辑不变。
Source: MCP tools
| - 方式一：只填 `certId`，推荐。 | ||
| - 方式二：填 `certName` + `certificate` + `privateKey`。 | ||
| - `certId` 与 PEM 三字段不要混用。 | ||
| - PEM 支持内联、本地文件路径、公网 URL、`oss://{region}/{bucket}/{object}`。 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file excerpt =="
sed -n '40,140p' .agents/skills/s-fc3/references/domain.md || true
echo "== references to PEM/privateKey/certId/public URL =="
rg -n "privateKey|certId|PEM|公网|public|URL|URL|https?://" .agents/skills/s-fc3/references/domain.md docs.serverless-devs.com 2>/dev/null || true
echo "== nearby domain guidance files =="
git ls-files | rg -n "domain|fc3" | sed -n '1,120p'Repository: devsapp/fc3
Length of output: 3310
🌐 Web query:
serverless devs fc3-domain certConfig certificate privateKey PEM public URL documentation
💡 Result:
In the Serverless Devs fc3-domain component, the certConfig property is used to configure HTTPS certificates [1][2]. You can manage certificates either by providing a certId (associated with an existing certificate in your Alibaba Cloud account) or by providing the certificate content directly using certName, certificate, and privateKey [1][2]. When using certName, certificate, and privateKey, the certificate and private key contents must be in PEM format [1][2][3]. The fc3-domain component is flexible regarding how you provide these PEM-formatted strings in your YAML file [2]: 1. Inline Content: You can paste the PEM-formatted string directly into the YAML file (using \n to represent line breaks) [2]. 2. Local File Path: You can provide a relative or absolute path to a local.pem or.key file [2]. 3. OSS URL: You can provide an OSS URI (e.g., oss://bucket-name/path/to/cert.pem) [4][2][5]. Note that certId is mutually exclusive with the combination of certName, certificate, and privateKey [1][2]. If you use certId, the certificate must reside in the same Alibaba Cloud account as the function [1]. Example YAML configuration using local files: resources: fc-domain-test: component: fc3-domain props: domainName: example.com protocol: HTTP,HTTPS routeConfig: routes: - functionName: test path: / certConfig: certName: my-cert certificate:./certs/certificate.pem privateKey:./certs/privateKey.pem For more details, refer to the official Serverless Devs fc3-domain YAML specifications [1][2].
Citations:
- 1: https://serverless-devs.com/docs/user-guide/aliyun/fc3-domain/spec/
- 2: https://docs.serverless-devs.com/user-guide/aliyun/fc3-domain/spec/
- 3: https://www.alibabacloud.com/help/en/functioncompute/fc/developer-reference/api-fc-2023-03-30-struct-certconfig
- 4: https://docs.serverless-devs.com/user-guide/aliyun/fc3-domain/example/
- 5: https://github.com/devsapp/fc3-domain/blob/master/README.md
🌐 Web query:
site:docs.serverless-devs.com/user-guide/aliyun/fc3-domain/spec fc3-domain certificate privateKey 公网 URL
💡 Result:
在阿里云函数计算 FC3 中配置自定义域名时，certConfig 下的 certificate（证书）和 privateKey（私钥）参数支持直接提供 PEM 格式的内容字符串，也支持通过 URL 获取 [1]。 根据 Serverless Devs 的 fc3-domain 组件规范，针对 certificate 和 privateKey 的配置方式如下： 1. 直接配置 PEM 格式内容： 可以直接将证书和私钥的 PEM 内容填入配置文件中，例如： certConfig: certName: my-cert certificate: '-----BEGIN CERTIFICATE-----\n... \n-----END CERTIFICATE-----' privateKey: '-----BEGIN RSA PRIVATE KEY-----\n... \n-----END RSA PRIVATE KEY-----' 2. 通过 URL 获取： 文档指出 certificate 和 privateKey 支持配置为可访问的公网 URL，包括 HTTP/HTTPS 地址或 OSS 地址 [1]。 - HTTP/HTTPS 地址：可以直接填写能够通过公网直接访问的 http 或 https 地址 [1]。 - OSS 地址：推荐使用 oss://{region}/{bucketName}/{objectName} 格式，但需要确保配置该资源的账号拥有获取 OSS 文件的权限 [1]。 在实际操作中，配置时必须确保证书和私钥内容均符合 PEM 格式要求 [1]。若使用公网 URL，请注意网络连通性及访问权限设置 [1]。
Citations:
Do not label public URLs as safe for privateKey.
fc3-domain has documented support for publicly reachable HTTP/HTTPS URLs, but this section should make clear that private-key material must only come from trusted, access-controlled sources. Remove or qualify “公网 URL” for privateKey, or require HTTPS and access controls explicitly.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~50-~50: 数词与名词之间一般应存在量词，可能缺少量词。
Context: ...icate+privateKey。 - certId 与 PEM 三字段不要混用。 - PEM 支持内联、本地文件路径、公网 URL、oss://{r...
(wa5)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/s-fc3/references/domain.md around lines 48 - 51, Update the
PEM source guidance near the certId/certificate/privateKey options to avoid
presenting public HTTP/HTTPS URLs as safe sources for privateKey material;
qualify URL support with HTTPS and trusted access controls, or state that
privateKey must use an access-controlled source while preserving supported
public-URL behavior for non-sensitive certificate data.
Source: MCP tools
| ## `domainName: auto` | ||
|
|
||
| - 会分配 `*.devsapp.net` 临时测试域名。 | ||
| - 通常约 1 天后回收。 | ||
| - 只适合学习和测试，不适合生产。 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Fc3 domain domainName auto temporary domain reclaim 30 days serverless-devs docs
💡 Result:
When using the fc3-domain component in Serverless Devs with the domain name configured as auto, the system automatically assigns a temporary test domain (in the format *.devsapp.net) provided by the CNCF Sandbox project Serverless Devs community [1][2]. Key points regarding this temporary domain: - Purpose: It is strictly for learning and testing purposes and must not be used for any production services [1][2]. - Reclaim Policy: The community performs irregular checks and will reclaim the temporary domain 30 days after it is issued [1][2]. - Behavior upon Reclaim: When a temporary domain is reclaimed after 30 days, a new temporary domain may be assigned [3], but relying on this is not recommended for stable applications. - Recommendation: For a stable, production-ready experience, it is strongly recommended that you bind your own custom domain that has completed ICP filing (if required) in China [1][2][4]. To avoid service interruptions associated with the temporary domain's lifecycle, you should configure a permanent custom domain in your configuration [1][2]. Once you have a custom domain, you can update your Serverless Devs YAML configuration to replace domainName: auto with your own domain name and configure the necessary routing and certificate settings [1][2][5].
Citations:
- 1: https://docs.serverless-devs.com/user-guide/aliyun/fc3-domain/spec/
- 2: https://serverless-devs.com/docs/user-guide/aliyun/fc3/spec/
- 3: https://developer.aliyun.com/ask/654944
- 4: https://www.alibabacloud.com/help/en/functioncompute/fc/user-guide/configure-custom-domain-names
- 5: https://serverless-devs.com/docs/user-guide/tips/
Correct the temporary-domain retention period.
domainName: auto temporary domains are reclaimed 30 days after issuance, not about one day. Update this line or omit the fixed retention period.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/s-fc3/references/domain.md around lines 53 - 57, Update the
domainName: auto section to state that temporary *.devsapp.net domains are
reclaimed 30 days after issuance, or remove the fixed retention-period statement
while preserving the learning/testing-only guidance.
Source: MCP tools
|
|
||
| ## 排障 | ||
|
|
||
| - HTTPS / 双协议时必须配 `certConfig` 或 `certId`。 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== context =="
cat -n .agents/skills/s-fc3/references/domain.md | sed -n '115,140p' || true
echo "== local references to certId/certConfig =="
rg -n "certId|certConfig" .agents/skills/s-fc3/references/domain.md .agents/skills/s-fc3 || true
echo "== web docs lookup hints =="
python3 - <<'PY'
from urllib.request import Request, urlopen
from urllib.error import URLError
url = "https://docs.serverless-devs.com/user-guide/aliyun/fc3-domain/spec"
req = Request(url, headers={"User-Agent":"CodeRabbit-verification/1.0"})
try:
with urlopen(req, timeout=20) as resp:
text = resp.read().decode("utf-8", errors="replace")
for needle in ["certConfig", "certId", "certificate"]:
idx=text.lower().find(needle.lower())
if idx!=-1:
print(f"\n--- {needle} context ---")
start=max(0, idx-400); end=min(len(text), idx+800)
print(text[start:end])
except Exception as e:
print(f"DOC_QUERY_ERROR: {type(e).__name__}: {e}")
PYRepository: devsapp/fc3
Length of output: 1944
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== domain.md top section =="
cat -n .agents/skills/s-fc3/references/domain.md | sed -n '1,70p'
echo "== search for top-level certId examples/doc references =="
rg -n -i "certId|certConfig|domainCertificate|DomainCertificate|证书配置|证书 ID|双协议|protocol.*https|HTTPS" .agents .github . 2>/dev/null | head -200 || true
echo "== inspect repository files that may contain the source of this doc excerpt =="
git ls-files | rg -i "domain|fc3|certificate|cert" || trueRepository: devsapp/fc3
Length of output: 32769
🌐 Web query:
Serverless Devs Aliyun FC3 domain certConfig certId spec certConfig.certId
💡 Result:
In the Serverless Devs fc3-domain component, certConfig.certId is used to configure HTTPS certificates by referencing an existing certificate ID from the Aliyun Digital Certificate Management Service [1][2]. Key points regarding certConfig.certId: 1. Configuration: The certId parameter is part of the certConfig structure [1]. When using certId, it is mutually exclusive with certName, privateKey, and certificate [1][2]. 2. Requirements: - The certificate and the function must belong to the same Aliyun account [1][2]. - The access credentials used by Serverless Devs must have the necessary permissions to retrieve certificate details from the Aliyun Digital Certificate Management Service [1][2]. 3. Example YAML snippet: yaml resources: fc-domain-test: component: fc3-domain props: domainName: test.com protocol: HTTP,HTTPS routeConfig: routes: - functionName: test methods: - GET path: /a qualifier: LATEST certConfig: certId: 123456 By providing the certId, Serverless Devs automatically retrieves the configuration from the Aliyun platform [1][2].
Citations:
- 1: https://docs.serverless-devs.com/user-guide/aliyun/fc3-domain/spec/
- 2: https://serverless-devs.com/docs/user-guide/aliyun/fc3-domain/spec/
Use the correct certificate field path.
certId is a child of certConfig; users should configure it under certConfig.certId, or use the PEM fields under certConfig. Change this line so it does not list a top-level certId alternative.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/s-fc3/references/domain.md at line 131, Update the
HTTPS/dual-protocol configuration guidance to require certificates under
certConfig, using certConfig.certId or the PEM fields within certConfig; remove
the top-level certId alternative.
Source: MCP tools
|
|
||
| | 现象 / 报错 | 可能原因 | 处理方向 | | ||
| |-------------|----------|----------| | ||
| | `AccessDenied` / 403 | RAM 权限不足 | 检查 `s config`；部署常用 `AliyunFCFullAccess` | |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate file =="
fd -a 'troubleshooting\.md$' . || true
echo "== file excerpt =="
if [ -f ".agents/skills/s-fc3/references/troubleshooting.md" ]; then
nl -ba ".agents/skills/s-fc3/references/troubleshooting.md" | sed -n '1,80p'
else
echo "target file not found"
fi
echo "== search permission guidance nearby =="
rg -n "AliyunFCFullAccess|ram:PassRole|fc\.aliyuncs\.com|AccessDenied|Permissions|权限" ".agents/skills/s-fc3/references" ".agents/skills" 2>/dev/null | head -120Repository: devsapp/fc3
Length of output: 226
🌐 Web query:
Aliyun FC3 minimum permissions ram:PassRole fc.aliyuncs.com execution role ARN serverless devs documentation
💡 Result:
To grant the necessary permissions for Function Compute (FC) 3.0 operations via Serverless Devs, you must provide the RAM user or role executing the deployment with the ram:PassRole permission [1][2][3]. This permission allows the Function Compute service to assume the specified execution role on your behalf [4][5]. The minimum policy required to permit the deployment of resources is as follows [1][3]: { "Version": "1", "Statement": [ { "Effect": "Allow", "Action": "ram:PassRole", "Resource": "*", "Condition": { "StringEquals": { "acs:Service": "fc.aliyuncs.com" } } } ] } Key Considerations: 1. PassRole Scope: Using Resource: "*" is common in deployment scripts, but you can restrict this to the specific ARN of the execution role (e.g., acs:ram::1234567890123456:role/my-fc-execution-role) to follow the principle of least privilege [1][3]. 2. Execution Role: The execution role (often referenced in your s.yaml as the role parameter) is the identity your function assumes during runtime to access other Alibaba Cloud services [4][5]. 3. Service-Linked Role: FC 3.0 utilizes a service-linked role (AliyunServiceRoleForFC) for internal tasks like logging and VPC integration [6][7]. You typically do not need to configure this manually as it is handled by the console or requested during initial deployment [6][7]. If a RAM user needs to manage this role, they require ram:CreateServiceLinkedRole and ram:DeleteServiceLinkedRole permissions [6][7]. 4. Serverless Devs: When using s.yaml, ensure the role attribute specifies the ARN of the RAM role you wish the function to assume [8][3]. If this is omitted, the function may use the default service-linked role or have no execution permissions depending on your configuration [4][9].
Citations:
- 1: https://help.aliyun.com/en/functioncompute/fc/policies-and-sample-policies
- 2: https://help.aliyun.com/en/functioncompute/fc-2-0/security-and-compliance/policies
- 3: https://docs.serverless-devs.com/user-guide/aliyun/fc3/spec/
- 4: https://help.aliyun.com/en/functioncompute/fc/grant-function-compute-permissions-to-access-other-alibaba-cloud-services
- 5: https://www.alibabacloud.com/help/en/functioncompute/fc-3-0/user-guide/creating-a-task-function
- 6: https://help.aliyun.com/en/functioncompute/fc/service-linked-role-of-function-compute
- 7: https://www.alibabacloud.com/help/en/functioncompute/fc/service-linked-role-of-function-compute
- 8: https://docs.serverless-devs.com/user-guide/aliyun/fc/yaml/service/
- 9: https://www.alibabacloud.com/help/en/functioncompute/fc/grant-function-compute-permissions-to-access-other-alibaba-cloud-services
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate file =="
find . -type f -path '*troubleshooting.md' 2>/dev/null
echo "== target file excerpt if present =="
if [ -f ".agents/skills/s-fc3/references/troubleshooting.md" ]; then
awk '{printf "%6d\t%s\n", NR, $0}' ".agents/skills/s-fc3/references/troubleshooting.md" | sed -n '1,90p'
else
echo "target file not found"
fi
echo "== search permission guidance in repository =="
grep -RInE "AliyunFCFullAccess|ram:PassRole|fc\.aliyuncs\.com|AccessDenied|Permissions|权限" ".agents/skills" 2>/dev/null | head -120 || trueRepository: devsapp/fc3
Length of output: 4903
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== related permission sections =="
awk '{printf "%6d\t%s\n", NR, $0}' ".agents/skills/s-fc3/SKILL.md" | sed -n '280,330p'Repository: devsapp/fc3
Length of output: 1638
🌐 Web query:
site:docs.serverless-devs.com/user-guide/aliyun/fc3 domain ram PassRole custom domain minimum permissions
💡 Result:
In the context of Aliyun (Alibaba Cloud) Serverless computing, the ram:PassRole permission is required when a RAM role is specified in a resource configuration (such as a function or custom domain) to allow the service to assume that role on your behalf [1][2]. To implement the minimum permissions for PassRole in this scenario, your IAM policy should restrict the Action to ram:PassRole and limit the Resource to the specific ARN of the role(s) you are authorized to pass. A minimal IAM policy template for PassRole would look like this: { "Version": "1", "Statement": [ { "Effect": "Allow", "Action": "ram:PassRole", "Resource": "acs:ram::{uid}:role/{roleName}" } ] } Replace {uid} with your Alibaba Cloud account ID and {roleName} with the name of the specific RAM role used for your function or custom domain configuration [1]. This ensures that only the intended roles can be assumed, following the principle of least privilege. If you are using broader permissions for deployment, you may have seen references to full access policies like AliyunFCFullAccess, but for production environments, creating a scoped-down policy as shown above is the standard security practice [3].
Citations:
- 1: https://docs.serverless-devs.com/user-guide/aliyun/fc3/spec/
- 2: https://docs.serverless-devs.com/user-guide/aliyun/fc3/example/
- 3: https://docs.serverless-devs.com/user-guide/aliyun/fc3/deploy/
Use least-privilege permission guidance.
Do not present AliyunFCFullAccess or full access operations as the normal deployment fix. Document the minimum FC actions and resource ARNs for the specific operation. For ram:PassRole, scope the resource to the exact execution-role ARN instead of relying only on the fc.aliyuncs.com condition. Keep full access only as a temporary troubleshooting fallback with an explicit warning.
Also applies to: 45-45
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/s-fc3/references/troubleshooting.md at line 7, Update the
AccessDenied/403 guidance in the troubleshooting table to recommend
least-privilege RAM permissions: document the minimum FC actions and resource
ARNs required for the relevant deployment operation, and scope ram:PassRole to
the exact execution-role ARN rather than only the fc.aliyuncs.com condition.
Retain AliyunFCFullAccess only as a clearly warned temporary troubleshooting
fallback.
Source: MCP tools
| s info | ||
| ``` | ||
|
|
||
| - `s logs` 的时间参数要带时区偏移，不能用 `Z`。 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
curl -fsSL \
'https://raw.githubusercontent.com/devsapp/fc3/master/src/subCommands/logs/index.ts' |
rg -n 'new Date\(sTime\)|new Date\(eTime\)'
node -e 'const d = new Date("2026-01-01T10:00:00Z"); if (Number.isNaN(d.getTime())) process.exit(1)'Repository: devsapp/fc3
Length of output: 273
🌐 Web query:
FC3 logs --startTime --endTime ISO 8601 Z timestamp documentation
💡 Result:
In the context of the Serverless Devs fc3 component, the logs command is used to query function execution logs [1][2]. For specifying time ranges, the command supports the --start-time (or short flag -s) and --end-time (or short flag -e) parameters [1]. Technical specifications for these parameters: - Format: You can provide values as either UTC time strings (ISO 8601-like formats) or Unix timestamps [1]. - Examples: - UTC Time String: 2023-11-02T14:00:00+08:00 or 2023-11-04T15:40:00 [1]. - Unix Timestamp: 1698904800000 (in milliseconds) [1]. When these parameters are not explicitly provided, the command defaults to querying logs from the most recent hour [1]. Command help can be retrieved by running s cli fc3 logs -h or s logs -h [1].
Citations:
- 1: https://serverless-devs.com/docs/user-guide/aliyun/fc3/logs/
- 2: https://github.com/devsapp/fc3/blob/master/publish.yaml
更新日志时间格式说明。
fc3 logs 现在接受 UTC 时间字符串和 Unix 时间戳，官方示例包含 +08:00 形式的 ISO-8601。将第 141 行的禁止改为说明支持标准偏移时间，避免用户不能按规范使用带时区的 UTC 时间字段。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/s-fc3/SKILL.md at line 141, 更新 s logs 的时间参数说明，移除“不能使用
Z”的禁止性表述，明确 fc3 logs 支持 UTC 时间字符串、Unix 时间戳及带标准时区偏移的 ISO-8601 时间（如 +08:00）。
Source: MCP tools
| ### 多环境（vars） | ||
|
|
||
| ```yaml | ||
| vars: | ||
| env: dev | ||
|
|
||
| resources: | ||
| my_func: | ||
| props: | ||
| functionName: my-func-${vars.env} | ||
| ``` | ||
|
|
||
| ```bash | ||
| s deploy --var env=staging | ||
| ``` | ||
|
|
||
| - 多环境切换也可以用 `s env`，按文档站用户手册 → 内置指令 → Env。 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
command -v s >/dev/null
s deploy -h | rg -n -- '--var|--env'
s preview -h | rg -n -- '--var|--env'Repository: devsapp/fc3
Length of output: 149
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repository files matching vars/skill/env:\n'
git ls-files | rg -n '(^|/)(SKILL.md|.*env.*|.*vars.*|.*vars.yml$|.*vars.yaml$|package.json$|s.yml$|s.yaml$)' || true
printf '\nTarget file excerpt:\n'
sed -n '220,280p' .agents/skills/s-fc3/SKILL.md
printf '\nSearch vars --var top-level vars in tracked files:\n'
rg -n --hidden -S '^\s*vars:|s\\b[^\\n]*--var|--var|vars\.env|\$\{vars\.env\}' .agents/skills/s-fc3/SKILL.md . || trueRepository: devsapp/fc3
Length of output: 4725
🌐 Web query:
Serverless Devs vars top-level vars --var s deploy --var documentation
💡 Result:
In Serverless Devs, vars is a top-level key defined in the s.yaml configuration file used to store global variables [1][2]. These variables provide a centralized way to define and reuse common values (such as region, domain names, or service settings) across multiple services within the same project [1][3][2]. Key aspects of vars include: - Definition: They are defined as Key-Value pairs under the vars section in s.yaml [1][2]. - Usage: You can reference these global variables in other parts of the configuration (such as in resource properties) using the syntax ${vars.variable_name} [1][2]. - Example: yaml vars: region: cn-hangzhou domain: example.com resources: my-service: component: fc3 props: region: ${vars.region} Regarding the s deploy command: - It is the standard command used to deploy resources defined in your s.yaml file to the cloud [4][5][6]. - It reads the configurations (including the values resolved from vars) and applies them to your cloud provider [4][7]. - While s deploy does not accept a --var flag to inject variables directly into the command line, you can manage environment-specific configurations or variable overrides through mechanisms such as s.yaml inheritance, environment variables (e.g., ${env('VAR_NAME')}), or external file references (${file('./path')}) [1][2]. There is no native s deploy --var command for passing variables directly at deployment time; configuration is primarily managed through the s.yaml file structure [1][8]. If you require dynamic variable injection, it is common practice to use shell environment variables or template processing tools prior to running the deployment command [2].
Citations:
- 1: https://docs.serverless-devs.com/user-guide/spec/
- 2: https://segmentfault.com/a/1190000041947908/en
- 3: https://docs.serverless-devs.com/dev-guide/application/
- 4: https://docs.serverless-devs.com/user-guide/aliyun/fc/command/deploy/
- 5: https://docs.serverless-devs.com/user-guide/aliyun/fc3/deploy/
- 6: https://github.com/devsapp/fc/blob/main/docs/en/command/deploy.md
- 7: https://serverless-devs.com/docs/getting-started/
- 8: https://github.com/Serverless-Devs/Serverless-Devs/blob/HEAD/readme_en.md
🌐 Web query:
Serverless Devs FC3 s deploy --var env=staging vars top-level vars documentation
💡 Result:
In Serverless Devs, the command s deploy --var env=staging is not a standard syntax for passing environment variables or defining staging configurations [1][2]. To manage multiple environments like "staging" in Serverless Devs, you should use the built-in Environment (Env) configuration feature rather than inline CLI arguments [1]. ### Managing Environments The recommended approach is to create an env.yaml file in your project directory [1]. This allows you to define environment-specific configurations that override the settings in your main s.yaml file [1]. 1. Create an env.yaml file that defines your environments: yaml - name: staging overlays: components: fc3: region: cn-hangzhou access: staging-access-key 2. Deploy using the --env flag [1]: bash s deploy --env staging The s deploy --env <env-name> command will automatically merge the settings defined in your env.yaml under the specified environment name into your s.yaml configuration [1]. ### Top-Level Vars Configuration Serverless Devs supports top-level variables defined in your s.yaml file under the vars key [3]. These act as global variables accessible throughout your configuration [3]. * Configuration in s.yaml: yaml vars: region: cn-hangzhou environment: staging resources: my-function: component: fc3 props: region: ${vars.region} # Reference the global variable ### Variable Substitution Syntax To reference variables within your s.yaml, use the ${} syntax [3]. Common variable sources include [3][4]: * Global variables: ${vars.key} * Machine environment variables: ${env('ENV_VAR_NAME')} * Configured access keys: ${config('AccountID')} * Other project outputs: ${resources.project_name.output.key} If you need to inject custom variables dynamically during deployment that aren't part of the env.yaml overlay system, the standard practice is to use ${env('VAR_NAME')} in your s.yaml and set those variables in your terminal session before running the deploy command (e.g., export MY_VAR=staging && s deploy) [4].
Citations:
- 1: https://serverless-devs.com/docs/user-guide/builtin/env/
- 2: https://docs.serverless-devs.com/user-guide/aliyun/fc3/deploy/
- 3: https://docs.serverless-devs.com/user-guide/spec/
- 4: https://serverless-devs.com/docs/user-guide/tips/
去掉不支持的 --var 用法。
vars 是 Serverless Devs 的顶层变量配置，${vars.env} 引用合法；但 s deploy --var env=staging 不是部署 CLI 的正式用法。切换多环境应保留 s env --env staging / s deploy --env staging，避免用户运行无效命令。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/s-fc3/SKILL.md around lines 247 - 263, 更新多环境（vars）示例，移除无效的 `s
deploy --var env=staging` 用法；保留 `${vars.env}` 配置引用，并改为使用 `s env --env staging` 或
`s deploy --env staging` 作为环境切换命令。
Source: MCP tools
| ### 自定义容器 | ||
|
|
||
| ```yaml | ||
| props: | ||
| runtime: custom-container | ||
| customContainerConfig: | ||
| image: registry.cn-hangzhou.aliyuncs.com/ns/repo:v1 | ||
| port: 9000 | ||
| command: ['/start.sh'] | ||
| ``` | ||
|
|
||
| ```bash | ||
| s build --dockerfile ./Dockerfile | ||
| s deploy --skip-push | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
curl -fsSL \
'https://docs.serverless-devs.com/user-guide/aliyun/fc3/deploy/' |
rg -n -- '--skip-push|跳过自动推送'Repository: devsapp/fc3
Length of output: 208
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '--- relevant docs snippet ---\n'
curl -fsSL 'https://docs.serverless-devs.com/user-guide/aliyun/fc3/deploy/' | \
sed -n '4880,4915p'
printf '\n--- local SKILL snippet ---\n'
sed -n '255,285p' .agents/skills/s-fc3/SKILL.md
printf '\n--- search for skip-push usage and deploy examples ---\n'
rg -n "skip-push|--skip-push|customContainerConfig|custom-container|s deploy" .agents/skills/s-fc3/SKILL.md . || trueRepository: devsapp/fc3
Length of output: 240
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- relevant docs snippet ---'
curl -fsSL 'https://docs.serverless-devs.com/user-guide/aliyun/fc3/deploy/' | \
sed -n '4880,4915p'
printf '%s\n' ''
printf '%s\n' '--- local SKILL snippet ---'
sed -n '255,285p' .agents/skills/s-fc3/SKILL.md
printf '%s\n' ''
printf '%s\n' '--- search for skip-push usage and deploy examples ---'
rg -n "skip-push|--skip-push|customContainerConfig|custom-container|s deploy" .agents/skills/s-fc3/SKILL.md . || trueRepository: devsapp/fc3
Length of output: 28848
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- custom container e2e yaml ---'
sed -n '1,35p' __tests__/e2e/custom-container/s.yaml
printf '%s\n' ''
printf '%s\n' '--- deploy image resolution and skip-push handling ---'
sed -n '170,215p' src/subCommands/deploy/impl/function.ts
sed -n '230,320p' src/subCommands/deploy/impl/function.ts
printf '%s\n' ''
printf '%s\n' '--- build dockerfile image handling ---'
sed -n '110,135p' src/subCommands/build/index.ts
sed -n '80,115p' src/subCommands/build/impl/baseBuilder.ts
printf '%s\n' ''
printf '%s\n' '--- acr push handling ---'
sed -n '105,125p' src/resources/acr/index.tsRepository: devsapp/fc3
Length of output: 8407
不要在首次构建后跳过镜像推送。
该示例的配置是自定义镜像地址，且 s build --dockerfile 不会直接推送镜像。s deploy --skip-push 会跳过自动推送 ACR 镜像，可能导致部署使用已存在的缓存镜像或部署失败，除非该镜像已经推送到该地址且与本地构建一致。首次构建使用 s deploy；后续如需跳过推送，请先补充推送已存在的相同镜像这一前置条件。
建议修改
s build --dockerfile ./Dockerfile
- s deploy --skip-push
+ s deploy📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ### 自定义容器 | |
| ```yaml | |
| props: | |
| runtime: custom-container | |
| customContainerConfig: | |
| image: registry.cn-hangzhou.aliyuncs.com/ns/repo:v1 | |
| port: 9000 | |
| command: ['/start.sh'] | |
| ``` | |
| ```bash | |
| s build --dockerfile ./Dockerfile | |
| s deploy --skip-push | |
| ``` | |
| ### 自定义容器 | |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/s-fc3/SKILL.md around lines 265 - 279,
更新“自定义容器”示例中的部署命令：首次构建后将 s deploy --skip-push 改为 s
deploy，确保本地构建镜像被推送；仅在后续已确认相同镜像已推送到 customContainerConfig.image 指定地址时说明可使用
--skip-push。
Source: MCP tools
| | 版本 / 别名 / 并发 / 弹性 | 通常需 `AliyunFCFullAccess` | | ||
| | 发布层 | `AliyunFCFullAccess` | | ||
|
|
||
| > 生产建议：用自定义策略替代 `AliyunFCFullAccess`，资源 ARN 收窄到 `acs:fc:{region}:{uid}:functions/{functionName}`；函数执行角色同样最小权限。 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
curl -fsSL \
'https://docs.serverless-devs.com/user-guide/aliyun/fc3/version/' |
rg -n -- 'versions'
curl -fsSL \
'https://docs.serverless-devs.com/user-guide/aliyun/fc3/alias/' |
rg -n -- 'aliases'Repository: devsapp/fc3
Length of output: 1027
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Inspect the advised policy section and nearby operation examples.
sed -n '320,360p' .agents/skills/s-fc3/SKILL.md
# Search for resource ARNs in the file to compare operations covered.
rg -n 'aliyun.*PolicyResource|Resource.*functions/\{functionName\}|versions/\*|aliases/\*' .agents/skills/s-fc3/SKILL.mdRepository: devsapp/fc3
Length of output: 321
🌐 Web query:
Aliyun FC 3 version alias resource ARN versions/* aliases/* policy resource
💡 Result:
In Alibaba Cloud Function Compute (FC) 3.0, access control for versions and aliases is managed through Resource Access Management (RAM) policies using Alibaba Cloud Resource Names (ARNs) [1][2]. The standard ARN format for FC resources is acs:fc:{region}:{accountId}:{resourceType}/{resourcePath} [2]. When defining policies for function versions and aliases in FC 3.0, you use specific path structures under the function resource [1]. Resource ARN Patterns For function versions and aliases, the ARN paths typically follow these patterns [1]: 1. Versions: To reference all versions of a function, use acs:fc:{region}:{accountId}:functions/{functionName}/versions/* [1]. To reference a specific version, use acs:fc:{region}:{accountId}:functions/{functionName}/versions/{versionId} [1]. 2. Aliases: To reference all aliases of a function, use acs:fc:{region}:{accountId}:functions/{functionName}/aliases/* [1]. To reference a specific alias, use acs:fc:{region}:{accountId}:functions/{functionName}/aliases/{aliasName} [1]. Policy Examples You can use these patterns in the Resource element of a RAM policy to grant or restrict specific actions [3]. Example for managing aliases: { "Version": "1", "Statement": [ { "Action": [ "fc:GetAlias", "fc:UpdateAlias", "fc:DeleteAlias" ], "Resource": "acs:fc:cn-hangzhou:12345678:functions/my-function/aliases/my-alias", "Effect": "Allow" } ] } Example for managing versions: { "Version": "1", "Statement": [ { "Action": [ "fc:DeleteFunctionVersion", "fc:GetFunction" ], "Resource": "acs:fc:cn-hangzhou:12345678:functions/my-function/versions/1", "Effect": "Allow" } ] } Notes: - Replace {region}, {accountId}, {functionName}, {versionId}, and {aliasName} with your actual resource values [2][4]. - Use the wildcard (*) to match all values for a specific segment if needed (e.g., all regions or all accounts) [2][4]. - Permissions are enforced at the API action level; ensure the Actions defined in your policy correspond to the required FC 3.0 API permissions [1][2].
Citations:
- 1: https://help.aliyun.com/en/functioncompute/fc/policies-and-sample-policies
- 2: https://www.alibabacloud.com/help/doc-detail/2618588.html
- 3: https://help.aliyun.com/en/ram/policy-structure-and-syntax
- 4: https://www.alibabacloud.com/help/en/ram/api-function-compute
为 FC3 的版本和别名操作指定子资源 ARN。
当前生产建议把自定义策略收窄为 acs:fc:{region}:{uid}:functions/{functionName}，仅覆盖函数级操作。FC3 的 publish version、delete version、add alias、add alias from published version 等需允许或限制 child resources，例如 versions/* / versions/{version} 或 aliases/* / aliases/{alias}；否则按此建议写入的自定义策略会拒绝合法操作。按操作拆分示例，或明确基础 ARN 仅用于函数级操作。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/s-fc3/SKILL.md at line 320, 更新 FC3 生产环境自定义策略建议，明确基础函数 ARN
仅适用于函数级操作，并为 publish/delete version、add alias 及相关别名操作补充对应的
versions/*、versions/{version}、aliases/* 或 aliases/{alias} 子资源
ARN；按操作拆分权限示例，确保合法的版本和别名操作不会被策略拒绝。
Source: MCP tools
1 participant
变更摘要
s-fc3Skill 内置到项目.agents/skills/s-fc3，支持以项目相对路径一键安装。.gitignore中忽略.codegraph/目录。文档正确性修复
基于 code review，修复 Skill 文档中多处“照做会翻车”的问题：
README.md：日志时间构造改为跨平台写法（macOS / Linux 分别给出）。SKILL.md：为s logs --search "ERROR" --match ERROR补全--match取值。references/troubleshooting.md：FC_DOCKER_VERSION由 3.0.0 更正为 3.1.0。references/domain.md：HTTP 示例中移除空的certConfig。references/release-ops.md：--additional-version-weight更正为--vw；s scaling put --max-instances用法；minCapacity/maxCapacity更正为minInstances/maxInstances。影响范围
仅新增 Skill 文档与调整
.gitignore，无代码逻辑改动。