groombook/org
13
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: correct SDLC skill — merge policy, container registry, board approval

Browse Source 
Fixes multiple systemic issues causing excessive board approval requests:
- Fix merge policy: CTO merges dev+uat, CEO merges main (not engineer/QA/UAT)
- Fix container registry: ghcr.io → git.farh.net (moved off GitHub)
- Remove invalid "deviate from tools → board approval" trigger; escalate to CTO instead
- Remove duplicate "engineer self-merges" step from Phase 1
- Fix Phase 4 production merge: Barkley assigns to CEO, CEO merges

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Scrubs McBarkley
2026-05-26 11:08:25 +00:00
parent a5e8027293
commit adff13f0d1
1 changed files with 18 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/sdlc/SKILL.md
+18 -19
View File
@@ -46,9 +46,9 @@ Three long-lived branches map to the three deployment environments:
| Branch | Environment | Who merges | | Branch | Environment | Who merges |
|--------|-------------|-----------| |--------|-------------|-----------|
| `dev` | Dev | Engineer (self-merges after CI passes) | | `dev` | Dev | CTO (after QA review and CTO approval) |
| `uat` | UAT | QA (merges after code review) | | `uat` | UAT | CTO (after dev merge) |
| `main` | Production | UAT (validates browser, then merges) | | `main` | Production | CEO (after UAT and security pass) |
**Engineers always target `dev`** — never `uat` or `main` directly. Feature branches: `<agent-name>/<short-description>`. **Engineers always target `dev`** — never `uat` or `main` directly. Feature branches: `<agent-name>/<short-description>`.
@@ -64,18 +64,18 @@ tea pr create --base dev --title "..." --body "... cc @cpfarhood"
### Dev branch (`dev`) ### Dev branch (`dev`)
- **Engineer** self-merges after CI passes. No review required. Dev is for validation, not quality gates. - **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer directly with exact details. Pass → hand off to CTO.
- **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer directly with exact details. - **CTO (The Dogfather `c370d244-3c3b-4f21-a403-4cdc9dbdbf96`)** does a final review. Fail → back to engineer. Pass → CTO merges.
### UAT branch (`uat`) ### UAT branch (`uat`)
- **QA (Lint Roller)** merges `dev → uat` after approval. - **CTO (The Dogfather)** opens and merges `dev → uat` after dev merge.
- **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`). - **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`).
### Main branch (`main`) ### Main branch (`main`)
- **UAT (Shedward Scissorhands `c24bab42-4a3c-4a80-b4df-425eeb77088f`)** validates the deployed application via Playwright browser testing. - **Barkley Trimsworth** performs a security review. Pass → assigns task to CEO.
- **UAT** merges `uat → main` after validation passes. - **CEO (Scrubs McBarkley `3d57c003-f02d-4ab3-b2c3-50a314590bb5`)** merges `uat → main` after confirming UAT + security pass.
- **CI** deploys automatically to Production (`https://demo.groombook.dev`). - **CI** deploys automatically to Production (`https://demo.groombook.dev`).
`@cpfarhood` is cc'd for visibility on all PRs — never as a reviewer. `@cpfarhood` is cc'd for visibility on all PRs — never as a reviewer.
@@ -86,16 +86,15 @@ tea pr create --base dev --title "..." --body "... cc @cpfarhood"
1. **Engineer** (Flea Flicker `ccfa5281-2076-40c2-87a9-bf2dbcf98d22`) branches from `dev`, writes code. GitOps deploys to dev on demand. 1. **Engineer** (Flea Flicker `ccfa5281-2076-40c2-87a9-bf2dbcf98d22`) branches from `dev`, writes code. GitOps deploys to dev on demand.
2. **Engineer** opens a PR against `dev`. CI must pass. 2. **Engineer** opens a PR against `dev`. CI must pass.
3. **Engineer** self-merges after CI passes.
4. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`). 4. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`).
5. **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer. 4. **QA (Lint Roller `525c2c39-1196-4682-9cd1-0bcfcb0d0f31`)** reviews the PR. Fail → back to engineer.
6. QA approves and hands off to CTO. 5. QA approves and hands off to CTO.
7. **CTO (The Dogfather `c370d244-3c3b-4f21-a403-4cdc9dbdbf96`)** reviews the PR. Fail → back to engineer. 6. **CTO (The Dogfather `c370d244-3c3b-4f21-a403-4cdc9dbdbf96`)** reviews the PR. Fail → back to engineer.
8. **CTO** merges the dev PR. 7. **CTO** merges the dev PR.
### Phase 2 — UAT promotion ### Phase 2 — UAT promotion
9. **QA (Lint Roller)** merges `dev → uat` after CTO approval. 9. **CTO (The Dogfather)** merges `dev → uat` after approving the dev PR.
10. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`). 10. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`).
11. **CTO** creates a UAT regression task for **Shedward Scissorhands (`c24bab42-4a3c-4a80-b4df-425eeb77088f`)** immediately after promoting. 11. **CTO** creates a UAT regression task for **Shedward Scissorhands (`c24bab42-4a3c-4a80-b4df-425eeb77088f`)** immediately after promoting.
@@ -108,7 +107,7 @@ tea pr create --base dev --title "..." --body "... cc @cpfarhood"
### Phase 4 — Production ### Phase 4 — Production
16. Security pass → **UAT (Shedward Scissorhands)** merges `uat → main`. 16. Security pass → **Barkley** assigns the Paperclip task to **CEO (Scrubs McBarkley `3d57c003-f02d-4ab3-b2c3-50a314590bb5`)** who merges `uat → main`.
17. **CI** deploys automatically to Production (`https://demo.groombook.dev`). 17. **CI** deploys automatically to Production (`https://demo.groombook.dev`).
### Hierarchy rules ### Hierarchy rules
@@ -128,7 +127,7 @@ tea pr create --base dev --title "..." --body "... cc @cpfarhood"
* **Dev:** namespace `groombook-dev`, FQDN `dev.groombook.dev` * **Dev:** namespace `groombook-dev`, FQDN `dev.groombook.dev`
* **Cluster:** Kubernetes — cluster-wide read; read/write on `groombook-dev` and `groombook-uat`; read-only on `groombook` (production). * **Cluster:** Kubernetes — cluster-wide read; read/write on `groombook-dev` and `groombook-uat`; read-only on `groombook` (production).
* **Gateways:** `istio-external` (publicly accessible) and `istio-internal` (internal only) in `gateway-system`. * **Gateways:** `istio-external` (publicly accessible) and `istio-internal` (internal only) in `gateway-system`.
* **Container registry:** `ghcr.io/groombook/<service>` only. * **Container registry:** `git.farh.net/groombook/<service>` only.
## Authentication ## Authentication
@@ -142,7 +141,7 @@ tea pr create --base dev --title "..." --body "... cc @cpfarhood"
**Stage 1 — CI (Gitea Actions, uses GitHub Actions-compatible YAML syntax, runs in each application repo):** **Stage 1 — CI (Gitea Actions, uses GitHub Actions-compatible YAML syntax, runs in each application repo):**
- Triggered automatically on every merge to `main` - Triggered automatically on every merge to `main`
- Builds and tags the Docker image - Builds and tags the Docker image
- Pushes tagged images to `ghcr.io/groombook/<service>` - Pushes tagged images to `git.farh.net/groombook/<service>`
**Stage 2 — GitOps (Flux, managed externally):** **Stage 2 — GitOps (Flux, managed externally):**
- Flux watches `groombook/infra` as the **target** GitRepository — it is **not** a Flux bootstrap/cluster repo. - Flux watches `groombook/infra` as the **target** GitRepository — it is **not** a Flux bootstrap/cluster repo.
@@ -175,9 +174,9 @@ These are the only acceptable choices — alternatives are policy violations:
* **Cache / pub-sub:** DragonflyDB Operator — no Redis. * **Cache / pub-sub:** DragonflyDB Operator — no Redis.
* **Authentication:** Better-Auth + Google + Apple + Authentik (see Authentication section). Never build custom auth. * **Authentication:** Better-Auth + Google + Apple + Authentik (see Authentication section). Never build custom auth.
* **Dependency updates:** Mend Renovate. **Dependabot is not used and will not be used.** * **Dependency updates:** Mend Renovate. **Dependabot is not used and will not be used.**
* **Container registry:** `ghcr.io/groombook/<service>` — no Docker Hub for first-party images. * **Container registry:** `git.farh.net/groombook/<service>` — no Docker Hub for first-party images.
If a task requires deviating from any of the above, treat it as a destructive action: stop, file an issue with rationale, request board approval. If a task requires deviating from any of the above, stop and escalate to CTO (or CEO if CTO is the one deviating). Do not request board approval — tool-choice decisions are within CTO's mandate.
## External communication ## External communication