Chris Farhood
d6b13fa58d
devops/SKILL.md is now the canonical home for infrastructure lifecycle (groombook/infra, single-branch main, Flux + OpenTofu controller, cluster topology). sdlc/SKILL.md is scoped to application code (3-branch dev/uat/main, Phases 1-5, Stage 1 CI image build, app-tool policy). Each skill cross-refs the other and defers to coding-standards/safety for cross-cutting rules rather than restating them. Fixes in devops/SKILL.md: - Rewrote frontmatter description (was a copy of sdlc, referenced phases and dev/uat/prod that do not apply). - Hoisted "applies to groombook/infra" to a top-level scope statement. - Renumbered the pipeline (was 1,2,3,4,4,5,4,5,5) and fixed --base dev -> --base main in the tea example. - Closed an unterminated bold marker. - Removed Authentication framework, Stage 1 image build, and the "never tofu / never kubectl apply" lines (now cited from sdlc / safety). - Trimmed the tools list to infra-only operators and controllers. Trims in sdlc/SKILL.md: - Removed Infrastructure topology, IaC, Stage 2 GitOps detail, the Flux Image Automation DENIED policy, the "never tofu / never kubectl apply" lines, and the External communication section (cited from devops / safety / coding-standards instead). - Trimmed the tools list to application-level dependency choices. - Added a pointer from Phase 5 into the devops pipeline. cc @cpfarhood Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
117 lines
5.5 KiB
Markdown
117 lines
5.5 KiB
Markdown
---
|
|
name: sdlc
|
|
description: >
|
|
Software development lifecycle for GroomBook application repos. Covers
|
|
Gitea authentication, the 3-branch dev/uat/main strategy, the SDLC
|
|
pipeline phases 1-5, the Stage 1 CI image build, the authentication
|
|
framework, and application-tool policy. For infrastructure
|
|
(groombook/infra), see the devops skill.
|
|
---
|
|
|
|
# Software Development Lifecycle
|
|
|
|
This skill governs **application code repos**. For infrastructure (`groombook/infra`), see the `devops` skill. For PR/test discipline and the `cc @cpfarhood` visibility rule, see `coding-standards`. For non-negotiable safety rules, see `safety`.
|
|
|
|
## Gitea authentication
|
|
|
|
**Use the `GITEA_TOKEN`** environment variable for all Gitea operations. It is already set in the agent environment. Use the **`tea`** CLI for all Gitea/Git operations (e.g., `tea issue list`, `tea pr create`). The token expires when the environment variable is rotated — re-invoke any Gitea operation if you get a 401.
|
|
|
|
Gitea is the **primary source of truth**. Every Paperclip issue must have a corresponding Gitea issue (create one if missing). Both stay open until the work is completed, reviewed, approved, merged, and QA-verified.
|
|
|
|
## Branch strategy
|
|
|
|
Three long-lived branches map to the three deployment environments:
|
|
|
|
| Branch | Environment | Who merges | Prerequisites for merge |
|
|
|--------|-------------|-----------|-----------|
|
|
| `dev` | Dev | Engineer | CI passes |
|
|
| `uat` | UAT | Engineer | QA code review approval |
|
|
| `main` | Production | Engineer | UAT validation & CTO code review |
|
|
|
|
**Engineers always target `dev` first** — never `uat` or `main` directly.
|
|
- Feature branches: `<agent-name>/<short-description>`.
|
|
|
|
## Pull requests
|
|
|
|
All changes happen via pull request. Gitea branch protection requires CI checks to pass. See `coding-standards` for the no-self-merge contract and the `cc @cpfarhood` visibility rule.
|
|
|
|
```bash
|
|
tea pr create --base dev --title "..." --body "... cc @cpfarhood"
|
|
```
|
|
|
|
## SDLC pipeline
|
|
|
|
### Phase 1 — Dev
|
|
|
|
1. **Engineer** branches from `dev`, writes code.
|
|
2. **Engineer** opens a PR against `dev`.
|
|
3. **CI** fail → back to **Engineer**.
|
|
4. **CI** pass → **Engineer** merges PR.
|
|
5. **CI** builds and deploys automatically to Dev (`https://dev.groombook.dev`).
|
|
|
|
### Phase 2 — UAT promotion
|
|
|
|
1. **Engineer** opens a PR from `dev` to `uat`.
|
|
2. **CI** fail → back to **Engineer** (return to Phase 1).
|
|
3. **CI** pass → **QA** performs code review.
|
|
4. **QA** rejected → back to **Engineer** (return to Phase 1).
|
|
5. **QA** approved → **Engineer** merges PR.
|
|
6. **CI** builds and deploys automatically to UAT (`https://uat.groombook.dev`).
|
|
|
|
### Phase 3 — User Testing & Security Review
|
|
|
|
1. **UAT (Shedward Scissorhands)** runs full regression against UAT — every feature, old and new, no exceptions.
|
|
2. **UAT** fail → back to **Engineer** (return to Phase 1).
|
|
3. **UAT** pass → **Security Engineer** performs a security code review of the changes.
|
|
4. **Security** fail → back to **Engineer** (return to Phase 1).
|
|
5. **Security** pass → Begin Phase 4.
|
|
|
|
### Phase 4 — Production Promotion
|
|
|
|
1. **Engineer** opens a PR from `uat` to `main`.
|
|
2. **CI** fail → back to **Engineer** (return to Phase 1).
|
|
3. **CI** pass → **CTO** performs code review.
|
|
4. **CTO** rejected → back to **Engineer** (return to Phase 1).
|
|
5. **CTO** approved → **Engineer** merges PR.
|
|
6. **CI** fail → back to **Engineer** (return to Phase 1).
|
|
7. **CI** pass → Begin Phase 5.
|
|
|
|
### Phase 5 — Production Deployment
|
|
|
|
1. **Engineer** opens a PR against `groombook/infra` to update the relevant Kustomize overlay with the new image tag.
|
|
2. **CI** fail → back to **Engineer** (return to Phase 1).
|
|
3. **CI** pass → **QA** performs code review.
|
|
4. **QA** rejected → back to **Engineer** (return to Phase 1).
|
|
5. **QA** approved → **Engineer** merges PR.
|
|
6. **Flux** reconciles `groombook/infra` on merge and rolls out the updated pods to production (`https://demo.groombook.dev`).
|
|
|
|
See the `devops` skill for the infrastructure pipeline that governs the `groombook/infra` PR in this phase, and for Flux reconciliation behavior.
|
|
|
|
## Stage 1 CI — Image build
|
|
|
|
Triggered automatically on every merge to `main` in an application repo:
|
|
- Builds and tags the Docker image: CalVer (`YYYY.MM.DD[.N]`), `latest`, and `sha-<hash>`
|
|
- Pushes tagged images to `git.farh.net/groombook/<service>` (see `coding-standards` for the registry and CalVer policy)
|
|
- Creates a CalVer git tag in the source repo
|
|
|
|
Stage 2 (Flux GitOps deployment) is owned by `devops`.
|
|
|
|
## Authentication
|
|
|
|
* **Framework:** Better-Auth.
|
|
* **OAuth Providers:** GroomBook (Authentik), Google, and Apple.
|
|
* **SSO:** Authentik OIDC at `https://auth.farh.net` (credentials in `authentik-credentials` secret).
|
|
* **Never build custom authentication.**
|
|
|
|
## Application tools (canonical, not alternatives)
|
|
|
|
These are application-level dependency choices. Alternatives are policy violations:
|
|
|
|
* **Database:** CloudNativePG-managed Postgres — no SQLite, MariaDB, or MySQL.
|
|
* **Cache / pub-sub:** DragonflyDB — no Redis.
|
|
* **Authentication:** Better-Auth + Google + Apple + Authentik (see Authentication above).
|
|
* **Dependency updates:** Mend Renovate. **Dependabot is not used and will not be used.** Do not configure it.
|
|
* **Browser automation:** the `playwright` MCP server (`http://playwright:8931/mcp`). Target dev only — never test production.
|
|
|
|
For the container registry, CalVer versioning, and general PR/test discipline, see `coding-standards`. For the operator install side (CNPG, Dragonfly, Sealed Secrets), see `devops`.
|