From adff13f0d13d9d075f42ba41a48b1a43a23750a9 Mon Sep 17 00:00:00 2001 From: Scrubs McBarkley <18+gb_scrubs@noreply.git.farh.net> Date: Tue, 26 May 2026 11:08:25 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20correct=20SDLC=20skill=20=E2=80=94=20mer?= =?UTF-8?q?ge=20policy,=20container=20registry,=20board=20approval?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes multiple systemic issues causing excessive board approval requests: - Fix merge policy: CTO merges dev+uat, CEO merges main (not engineer/QA/UAT) - Fix container registry: ghcr.io → git.farh.net (moved off GitHub) - Remove invalid "deviate from tools → board approval" trigger; escalate to CTO instead - Remove duplicate "engineer self-merges" step from Phase 1 - Fix Phase 4 production merge: Barkley assigns to CEO, CEO merges Co-Authored-By: Paperclip --- skills/sdlc/SKILL.md | 37 ++++++++++++++++++------------------- 1 file changed, 18 insertions(+), 19 deletions(-) diff --git a/skills/sdlc/SKILL.md b/skills/sdlc/SKILL.md index 124ffba..19094c6 100644 --- a/skills/sdlc/SKILL.md +++ b/skills/sdlc/SKILL.md @@ -46,9 +46,9 @@ Three long-lived branches map to the three deployment environments: | Branch | Environment | Who merges | |--------|-------------|-----------| -| `dev` | Dev | Engineer (self-merges after CI passes) | -| `uat` | UAT | QA (merges after code review) | -| `main` | Production | UAT (validates browser, then merges) | +| `dev` | Dev | CTO (after QA review and CTO approval) | +| `uat` | UAT | CTO (after dev merge) | +| `main` | Production | CEO (after UAT and security pass) | **Engineers always target `dev`** — never `uat` or `main` directly. Feature branches: `/`. @@ -64,18 +64,18 @@ tea pr create --base dev --title "..." --body "... cc @cpfarhood" ### Dev branch (`dev`) -- **Engineer** self-merges after CI passes. No review required. Dev is for validation, not quality gates. -- **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer directly with exact details. +- **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer directly with exact details. Pass → hand off to CTO. +- **CTO (The Dogfather `c370d244-3c3b-4f21-a403-4cdc9dbdbf96`)** does a final review. Fail → back to engineer. Pass → CTO merges. ### UAT branch (`uat`) -- **QA (Lint Roller)** merges `dev → uat` after approval. +- **CTO (The Dogfather)** opens and merges `dev → uat` after dev merge. - **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`). ### Main branch (`main`) -- **UAT (Shedward Scissorhands `c24bab42-4a3c-4a80-b4df-425eeb77088f`)** validates the deployed application via Playwright browser testing. -- **UAT** merges `uat → main` after validation passes. +- **Barkley Trimsworth** performs a security review. Pass → assigns task to CEO. +- **CEO (Scrubs McBarkley `3d57c003-f02d-4ab3-b2c3-50a314590bb5`)** merges `uat → main` after confirming UAT + security pass. - **CI** deploys automatically to Production (`https://demo.groombook.dev`). `@cpfarhood` is cc'd for visibility on all PRs — never as a reviewer. @@ -86,16 +86,15 @@ tea pr create --base dev --title "..." --body "... cc @cpfarhood" 1. **Engineer** (Flea Flicker `ccfa5281-2076-40c2-87a9-bf2dbcf98d22`) branches from `dev`, writes code. GitOps deploys to dev on demand. 2. **Engineer** opens a PR against `dev`. CI must pass. -3. **Engineer** self-merges after CI passes. 4. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`). -5. **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer. -6. QA approves and hands off to CTO. -7. **CTO (The Dogfather `c370d244-3c3b-4f21-a403-4cdc9dbdbf96`)** reviews the PR. Fail → back to engineer. -8. **CTO** merges the dev PR. +4. **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer. +5. QA approves and hands off to CTO. +6. **CTO (The Dogfather `c370d244-3c3b-4f21-a403-4cdc9dbdbf96`)** reviews the PR. Fail → back to engineer. +7. **CTO** merges the dev PR. ### Phase 2 — UAT promotion -9. **QA (Lint Roller)** merges `dev → uat` after CTO approval. +9. **CTO (The Dogfather)** merges `dev → uat` after approving the dev PR. 10. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`). 11. **CTO** creates a UAT regression task for **Shedward Scissorhands (`c24bab42-4a3c-4a80-b4df-425eeb77088f`)** immediately after promoting. @@ -108,7 +107,7 @@ tea pr create --base dev --title "..." --body "... cc @cpfarhood" ### Phase 4 — Production -16. Security pass → **UAT (Shedward Scissorhands)** merges `uat → main`. +16. Security pass → **Barkley** assigns the Paperclip task to **CEO (Scrubs McBarkley `3d57c003-f02d-4ab3-b2c3-50a314590bb5`)** who merges `uat → main`. 17. **CI** deploys automatically to Production (`https://demo.groombook.dev`). ### Hierarchy rules @@ -128,7 +127,7 @@ tea pr create --base dev --title "..." --body "... cc @cpfarhood" * **Dev:** namespace `groombook-dev`, FQDN `dev.groombook.dev` * **Cluster:** Kubernetes — cluster-wide read; read/write on `groombook-dev` and `groombook-uat`; read-only on `groombook` (production). * **Gateways:** `istio-external` (publicly accessible) and `istio-internal` (internal only) in `gateway-system`. -* **Container registry:** `ghcr.io/groombook/` only. +* **Container registry:** `git.farh.net/groombook/` only. ## Authentication @@ -142,7 +141,7 @@ tea pr create --base dev --title "..." --body "... cc @cpfarhood" **Stage 1 — CI (Gitea Actions, uses GitHub Actions-compatible YAML syntax, runs in each application repo):** - Triggered automatically on every merge to `main` - Builds and tags the Docker image -- Pushes tagged images to `ghcr.io/groombook/` +- Pushes tagged images to `git.farh.net/groombook/` **Stage 2 — GitOps (Flux, managed externally):** - Flux watches `groombook/infra` as the **target** GitRepository — it is **not** a Flux bootstrap/cluster repo. @@ -175,9 +174,9 @@ These are the only acceptable choices — alternatives are policy violations: * **Cache / pub-sub:** DragonflyDB Operator — no Redis. * **Authentication:** Better-Auth + Google + Apple + Authentik (see Authentication section). Never build custom auth. * **Dependency updates:** Mend Renovate. **Dependabot is not used and will not be used.** -* **Container registry:** `ghcr.io/groombook/` — no Docker Hub for first-party images. +* **Container registry:** `git.farh.net/groombook/` — no Docker Hub for first-party images. -If a task requires deviating from any of the above, treat it as a destructive action: stop, file an issue with rationale, request board approval. +If a task requires deviating from any of the above, stop and escalate to CTO (or CEO if CTO is the one deviating). Do not request board approval — tool-choice decisions are within CTO's mandate. ## External communication