Files

T

Chris Farhood 11fd2a4c34 Collapse sdlc Phase 5 to a redirect into the devops pipeline

Phase 5 is an infra PR against groombook/infra, which means it is governed
by the devops pipeline. Spelling out a separate (QA-only) review flow here
both duplicates devops and contradicted its QA+CTO requirement. Replaced
the step list with a one-paragraph hand-off.

Resolves the policy ambiguity flagged in the PR description.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-27 21:16:10 -04:00

5.2 KiB

Raw Blame History

name, description

name	description
sdlc	Software development lifecycle for GroomBook application repos. Covers Gitea authentication, the 3-branch dev/uat/main strategy, the SDLC pipeline phases 1-5, the Stage 1 CI image build, the authentication framework, and application-tool policy. For infrastructure (groombook/infra), see the devops skill.

Software Development Lifecycle

This skill governs application code repos. For infrastructure (groombook/infra), see the devops skill. For PR/test discipline and the cc @cpfarhood visibility rule, see coding-standards. For non-negotiable safety rules, see safety.

Gitea authentication

Use the GITEA_TOKEN environment variable for all Gitea operations. It is already set in the agent environment. Use the tea CLI for all Gitea/Git operations (e.g., tea issue list, tea pr create). The token expires when the environment variable is rotated — re-invoke any Gitea operation if you get a 401.

Gitea is the primary source of truth. Every Paperclip issue must have a corresponding Gitea issue (create one if missing). Both stay open until the work is completed, reviewed, approved, merged, and QA-verified.

Branch strategy

Three long-lived branches map to the three deployment environments:

Branch	Environment	Who merges	Prerequisites for merge
`dev`	Dev	Engineer	CI passes
`uat`	UAT	Engineer	QA code review approval
`main`	Production	Engineer	UAT validation & CTO code review

Engineers always target dev first — never uat or main directly.

Feature branches: <agent-name>/<short-description>.

Pull requests

All changes happen via pull request. Gitea branch protection requires CI checks to pass. See coding-standards for the no-self-merge contract and the cc @cpfarhood visibility rule.

tea pr create --base dev --title "..." --body "... cc @cpfarhood"

SDLC pipeline

Phase 1 — Dev

Engineer branches from dev, writes code.
Engineer opens a PR against dev.
CI fail → back to Engineer.
CI pass → Engineer merges PR.
CI builds and deploys automatically to Dev (https://dev.groombook.dev).

Phase 2 — UAT promotion

Engineer opens a PR from dev to uat.
CI fail → back to Engineer (return to Phase 1).
CI pass → QA performs code review.
QA rejected → back to Engineer (return to Phase 1).
QA approved → Engineer merges PR.
CI builds and deploys automatically to UAT (https://uat.groombook.dev).

Phase 3 — User Testing & Security Review

UAT (Shedward Scissorhands) runs full regression against UAT — every feature, old and new, no exceptions.
UAT fail → back to Engineer (return to Phase 1).
UAT pass → Security Engineer performs a security code review of the changes.
Security fail → back to Engineer (return to Phase 1).
Security pass → Begin Phase 4.

Phase 4 — Production Promotion

Engineer opens a PR from uat to main.
CI fail → back to Engineer (return to Phase 1).
CI pass → CTO performs code review.
CTO rejected → back to Engineer (return to Phase 1).
CTO approved → Engineer merges PR.
CI fail → back to Engineer (return to Phase 1).
CI pass → Begin Phase 5.

Phase 5 — Production Deployment

The Engineer opens a PR against groombook/infra to update the relevant Kustomize overlay with the new image tag. From this point the work follows the devops skill pipeline end-to-end — review, merge, and Flux reconciliation are all owned there. On merge, Flux rolls out the updated pods to production (https://demo.groombook.dev).

Stage 1 CI — Image build

Triggered automatically on every merge to main in an application repo:

Builds and tags the Docker image: CalVer (YYYY.MM.DD[.N]), latest, and sha-<hash>
Pushes tagged images to git.farh.net/groombook/<service> (see coding-standards for the registry and CalVer policy)
Creates a CalVer git tag in the source repo

Stage 2 (Flux GitOps deployment) is owned by devops.

Authentication

Framework: Better-Auth.
OAuth Providers: GroomBook (Authentik), Google, and Apple.
SSO: Authentik OIDC at https://auth.farh.net (credentials in authentik-credentials secret).
Never build custom authentication.

Application tools (canonical, not alternatives)

These are application-level dependency choices. Alternatives are policy violations:

Database: CloudNativePG-managed Postgres — no SQLite, MariaDB, or MySQL.
Cache / pub-sub: DragonflyDB — no Redis.
Authentication: Better-Auth + Google + Apple + Authentik (see Authentication above).
Dependency updates: Mend Renovate. Dependabot is not used and will not be used. Do not configure it.
Browser automation: the playwright MCP server (http://playwright:8931/mcp). Target dev only — never test production.

For the container registry, CalVer versioning, and general PR/test discipline, see coding-standards. For the operator install side (CNPG, Dragonfly, Sealed Secrets), see devops.

5.2 KiB Raw Blame History