groombook/org
13
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'udpate sdlc' (#8) from sdlc-updates into main

Browse Source 
Reviewed-on: #8
This commit was merged in pull request #8.
This commit is contained in:
Chris Farhood
2026-05-27 03:03:37 +00:00
parent 2ae9c4c2d4 a51b28a315
commit 93927ea402
1 changed files with 33 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/sdlc/SKILL.md
+33 -86
View File
@@ -16,38 +16,19 @@ description: >
Gitea is the **primary source of truth**. Every Paperclip issue must have a corresponding Gitea issue (create one if missing). Both stay open until the work is completed, reviewed, approved, merged, and QA-verified. Gitea is the **primary source of truth**. Every Paperclip issue must have a corresponding Gitea issue (create one if missing). Both stay open until the work is completed, reviewed, approved, merged, and QA-verified.
## Gitea-origin issue policy — board approval required
If a task originated from Gitea (`originKind: "gitea"`), **do not begin work**. Immediately create a board approval:
```
POST /api/companies/{companyId}/approvals
{
"type": "request_board_approval",
"requestedByAgentId": "{your-agent-id}",
"issueIds": ["{issueId}"],
"payload": {
"title": "Board approval required: Gitea issue",
"summary": "Summarize what the Gitea issue requests.",
"recommendedAction": "Approve to begin work.",
"risks": ["Work begins without board review if approved."]
}
}
```
Set the issue to `blocked` with a comment linking to the approval. Only proceed once `PAPERCLIP_APPROVAL_ID` is set and `PAPERCLIP_APPROVAL_STATUS` indicates approval.
## Branch strategy ## Branch strategy
Three long-lived branches map to the three deployment environments: Three long-lived branches map to the three deployment environments:
| Branch | Environment | Who merges | | Branch | Environment | Who merges | Prerequisites for merge |
|--------|-------------|-----------| |--------|-------------|-----------|-----------|
| `dev` | Dev | Engineer (self-merges after CI passes) | | `dev` | Dev | Engineer | None (self-merges after CI passes) |
| `uat` | UAT | QA (merges after code review) | | `uat` | UAT | Engineer | QA code review approval |
| `main` | Production | CEO (merges after UAT validation) | | `main` | Production | Engineer | UAT validation & CTO code review |
**Engineers always target `dev`** — never `uat` or `main` directly. Feature branches: `<agent-name>/<short-description>`. **Engineers always target `dev` first** — never `uat` or `main` directly.
- Feature branches: `<agent-name>/<short-description>`.
## Pull requests ## Pull requests
@@ -57,75 +38,43 @@ All changes happen via pull request. Always include `cc @cpfarhood` at the botto
tea pr create --base dev --title "..." --body "... cc @cpfarhood" tea pr create --base dev --title "..." --body "... cc @cpfarhood"
``` ```
Gitea branch protection requires CI checks (lint, test, build-and-push). Governance is enforced through Paperclip. Gitea branch protection requires CI checks to pass.
## PR review & merge policy
### Dev branch (`dev`)
- **Engineer** self-merges after CI passes. Dev is for validation, not quality gates.
- **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer with exact details.
- QA approves and hands off to CTO.
- **CTO (The Dogfather `c370d244-3c3b-4f21-a403-4cdc9dbdbf96`)** reviews the PR. Fail → back to engineer.
- **CTO** merges the dev PR.
### UAT branch (`uat`)
- **CTO** opens and merges a PR from `dev` to `uat`.
- **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`).
- **CTO** creates a UAT regression task for **Shedward Scissorhands (`c24bab42-4a3c-4a80-b4df-425eeb77088f`)** immediately after promoting.
### Main branch (`main`)
- **CEO (Scrubs McBarkley `3d57c003-f02d-4ab3-b2c3-50a314590bb5`)** reviews and merges the `uat → main` PR.
- **CI** deploys automatically to Production (`https://demo.groombook.dev`).
`@cpfarhood` is cc'd for visibility on all PRs — never as a reviewer.
## SDLC pipeline ## SDLC pipeline
### Phase 1 — Dev ### Phase 1 — Dev
1. **Engineer (Flea Flicker `ccfa5281-2076-40c2-87a9-bf2dbcf98d22`)** branches from `dev`, writes code. GitOps deploys to dev on demand. 1. **Engineer** branches from `dev`, writes code.
2. **Engineer** opens a PR against `dev`. CI must pass. 2. **Engineer** opens a PR against `dev`.
3. **Engineer** self-merges after CI passes. 3. **CI** fail → back to **Engineer**.
4. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`). 4. **CI** pass → **Engineer** merges PR.
5. **QA (Lint Roller)** reviews the PR. Fail → back to engineer. 5. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`).
6. QA approves and hands off to CTO.
7. **CTO (The Dogfather)** reviews the PR. Fail → back to engineer.
8. **CTO** merges the dev PR.
### Phase 2 — UAT promotion ### Phase 2 — UAT promotion
9. **CTO** opens and merges a PR from `dev` to `uat`. 1. **Engineer** opens a PR from `dev` to `uat`.
10. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`). 2. **CI** fail → back to **Engineer** (return to Phase 1).
3. **CI** pass → **QA** performs code review.
4. **QA** rejected → back to **Engineer** (return to Phase 1).
5. **QA** approved → **Engineer** merges PR.
6. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`).
### Phase 3 — UAT testing & security ### Phase 3 — User Testing & Security Review
11. **UAT (Shedward Scissorhands)** runs full regression against UAT — every feature, old and new, no exceptions. 1. **UAT (Shedward Scissorhands)** runs full regression against UAT — every feature, old and new, no exceptions.
12. UAT fail → CTO redistributes to engineer (return to Phase 1). 2. **UAT** fail → back to **Engineer** (return to Phase 1).
13. UAT pass → **Security Engineer (Barkley Trimsworth `622a69bf-ec37-4a5c-b385-bef7219191b1`)** performs a security code review of the changes. 3. **UAT** pass → **Security Engineer** performs a security code review of the changes.
14. Security fail → CTO redistributes to engineer (return to Phase 1). 4. **Security** fail → back to **Engineer** (return to Phase 1).
5. **Security** pass → **Engineer** opens a PR from `uat` to `main`.
6. **CI** fail → back to **Engineer** (return to Phase 1).
7. **CI** pass → Begin Phase 4.
### Phase 4 — Production ### Phase 4 — Production
15. Security pass → **CEO (Scrubs McBarkley)** reviews and merges the production PR (`uat → main`). Fail → back to CTO. 1. **CTO** performs code review.
16. **CI** deploys automatically to Production (`https://demo.groombook.dev`). 2. **CTO** approved → **Engineer** merges PR.
3. **CTO** rejected → back to **Engineer** (return to Phase 1).
### Hierarchy rules 4. **CI** deploys automatically to Production (`https://demo.groombook.dev`).
* CTO rejections at Dev go directly to the engineer (not back through QA).
* UAT failures (Shedward Scissorhands) go to CTO — CTO cascades to engineer.
* Security failures (Barkley Trimsworth) go to CTO — CTO cascades to engineer.
* CEO rejections at Prod go to CTO.
> **Note on penetration testing:** Barkley Trimsworth performs scheduled penetration testing against Prod independently of the PR workflow. Board-authorized. Not triggered per-PR.
## Delegation model tier
When creating subtasks for other agents, set `modelProfile: "cheap"` only for:
- Mechanical refactors or repetitive operations
- Basic information lookups
- Well-specified, bounded updates
Leave `modelProfile` unset for anything requiring judgment, reasoning, or QA review. When in doubt, leave it unset.
## Infrastructure ## Infrastructure
@@ -139,7 +88,7 @@ Leave `modelProfile` unset for anything requiring judgment, reasoning, or QA rev
## Authentication ## Authentication
* **Framework:** Better-Auth. * **Framework:** Better-Auth.
* **Social login:** Google and Apple OAuth. * **OAuth Providers:** GroomBook (Authentik), Google and Apple.
* **SSO:** Authentik OIDC at `https://auth.farh.net` (credentials in `authentik-credentials` secret). * **SSO:** Authentik OIDC at `https://auth.farh.net` (credentials in `authentik-credentials` secret).
* **Never build custom authentication.** * **Never build custom authentication.**
@@ -172,7 +121,7 @@ kubectl rollout restart deployment/<name> -n <namespace>
Terraform (OpenTofu) is deployed via the **Flux OpenTofu Controller** in a GitOps fashion. Submit Terraform configurations via a PR to `groombook/infra` — the tofu controller reconciles them on merge. Terraform (OpenTofu) is deployed via the **Flux OpenTofu Controller** in a GitOps fashion. Submit Terraform configurations via a PR to `groombook/infra` — the tofu controller reconciles them on merge.
**Never run `tofu` directly.** Never `kubectl apply` against production. Production changes go through Flux only. The `groombook-dev` and `groombook-uat` namespaces permit direct kubectl use for iteration. **Never run `tofu` directly.** Never `kubectl apply` against production. Production changes go through Flux only. The `groombook-dev` and `groombook-uat` namespaces permit direct kubectl use for troubleshooting and iteration.
## Tools (canonical, not alternatives) ## Tools (canonical, not alternatives)
@@ -186,8 +135,6 @@ These are the only acceptable choices — alternatives are policy violations:
* **Container registry:** `git.farh.net/groombook/<service>` — no Docker Hub for first-party images. * **Container registry:** `git.farh.net/groombook/<service>` — no Docker Hub for first-party images.
* **Browser automation:** the `playwright` MCP server (`http://playwright:8931/mcp`). Target dev only — never test production. * **Browser automation:** the `playwright` MCP server (`http://playwright:8931/mcp`). Target dev only — never test production.
If a task requires deviating from any of the above, treat it as a destructive action: stop, file an issue with rationale, request board approval.
## External communication ## External communication
When communicating in any context visible outside the GroomBook agent team (external users, human reviewers, non-agent entities), include `cc @cpfarhood` for visibility — never as a reviewer. When communicating in any context visible outside the GroomBook agent team (external users, human reviewers, non-agent entities), include `cc @cpfarhood` for visibility — never as a reviewer.