diff --git a/.agents/skills/github-actions-templates/SKILL.md b/.agents/skills/github-actions-templates/SKILL.md new file mode 100644 index 0000000..63feaad --- /dev/null +++ b/.agents/skills/github-actions-templates/SKILL.md @@ -0,0 +1,328 @@ +--- +name: github-actions-templates +description: Create production-ready GitHub Actions workflows for automated testing, building, and deploying applications. Use when setting up CI/CD with GitHub Actions, automating development workflows, or creating reusable workflow templates. +--- + +# GitHub Actions Templates + +Production-ready GitHub Actions workflow patterns for testing, building, and deploying applications. + +## Purpose + +Create efficient, secure GitHub Actions workflows for continuous integration and deployment across various tech stacks. + +## When to Use + +- Automate testing and deployment +- Build Docker images and push to registries +- Deploy to Kubernetes clusters +- Run security scans +- Implement matrix builds for multiple environments + +## Common Workflow Patterns + +### Pattern 1: Test Workflow + +```yaml +name: Test + +on: + push: + branches: [main, develop] + pull_request: + branches: [main] + +jobs: + test: + runs-on: ubuntu-latest + + strategy: + matrix: + node-version: [18.x, 20.x] + + steps: + - uses: actions/checkout@v4 + + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v4 + with: + node-version: ${{ matrix.node-version }} + cache: "npm" + + - name: Install dependencies + run: npm ci + + - name: Run linter + run: npm run lint + + - name: Run tests + run: npm test + + - name: Upload coverage + uses: codecov/codecov-action@v4 + with: + files: ./coverage/lcov.info +``` + +**Reference:** See `assets/test-workflow.yml` + +### Pattern 2: Build and Push Docker Image + +```yaml +name: Build and Push + +on: + push: + branches: [main] + tags: ["v*"] + +env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }} + +jobs: + build: + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + + steps: + - uses: actions/checkout@v4 + + - name: Log in to Container Registry + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + + - name: Build and push + uses: docker/build-push-action@v5 + with: + context: . + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max +``` + +**Reference:** See `assets/deploy-workflow.yml` + +### Pattern 3: Deploy to Kubernetes + +```yaml +name: Deploy to Kubernetes + +on: + push: + branches: [main] + +jobs: + deploy: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + aws-region: us-west-2 + + - name: Update kubeconfig + run: | + aws eks update-kubeconfig --name production-cluster --region us-west-2 + + - name: Deploy to Kubernetes + run: | + kubectl apply -f k8s/ + kubectl rollout status deployment/my-app -n production + kubectl get services -n production + + - name: Verify deployment + run: | + kubectl get pods -n production + kubectl describe deployment my-app -n production +``` + +### Pattern 4: Matrix Build + +```yaml +name: Matrix Build + +on: [push, pull_request] + +jobs: + build: + runs-on: ${{ matrix.os }} + + strategy: + matrix: + os: [ubuntu-latest, macos-latest, windows-latest] + python-version: ["3.9", "3.10", "3.11", "3.12"] + + steps: + - uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: ${{ matrix.python-version }} + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install -r requirements.txt + + - name: Run tests + run: pytest +``` + +**Reference:** See `assets/matrix-build.yml` + +## Workflow Best Practices + +1. **Use specific action versions** (@v4, not @latest) +2. **Cache dependencies** to speed up builds +3. **Use secrets** for sensitive data +4. **Implement status checks** on PRs +5. **Use matrix builds** for multi-version testing +6. **Set appropriate permissions** +7. **Use reusable workflows** for common patterns +8. **Implement approval gates** for production +9. **Add notification steps** for failures +10. **Use self-hosted runners** for sensitive workloads + +## Reusable Workflows + +```yaml +# .github/workflows/reusable-test.yml +name: Reusable Test Workflow + +on: + workflow_call: + inputs: + node-version: + required: true + type: string + secrets: + NPM_TOKEN: + required: true + +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: ${{ inputs.node-version }} + - run: npm ci + - run: npm test +``` + +**Use reusable workflow:** + +```yaml +jobs: + call-test: + uses: ./.github/workflows/reusable-test.yml + with: + node-version: "20.x" + secrets: + NPM_TOKEN: ${{ secrets.NPM_TOKEN }} +``` + +## Security Scanning + +```yaml +name: Security Scan + +on: + push: + branches: [main] + pull_request: + branches: [main] + +jobs: + security: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@0.28.0 + with: + scan-type: "fs" + scan-ref: "." + format: "sarif" + output: "trivy-results.sarif" + + - name: Upload Trivy results to GitHub Security + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: "trivy-results.sarif" + + - name: Run Snyk Security Scan + uses: snyk/actions/node@0.4.0 + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} +``` + +## Deployment with Approvals + +```yaml +name: Deploy to Production + +on: + push: + tags: ["v*"] + +jobs: + deploy: + runs-on: ubuntu-latest + environment: + name: production + url: https://app.example.com + + steps: + - uses: actions/checkout@v4 + + - name: Deploy application + run: | + echo "Deploying to production..." + # Deployment commands here + + - name: Notify Slack + if: success() + uses: slackapi/slack-github-action@v1 + with: + webhook-url: ${{ secrets.SLACK_WEBHOOK }} + payload: | + { + "text": "Deployment to production completed successfully!" + } +``` + + +## Related Skills + +- `gitlab-ci-patterns` - For GitLab CI workflows +- `deployment-pipeline-design` - For pipeline architecture +- `secrets-management` - For secrets handling diff --git a/.claude/skills/github-actions-templates b/.claude/skills/github-actions-templates new file mode 120000 index 0000000..8b2e120 --- /dev/null +++ b/.claude/skills/github-actions-templates @@ -0,0 +1 @@ +../../.agents/skills/github-actions-templates \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ad1bab6..f90158d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,7 +3,7 @@ name: CI on: pull_request: push: - branches: [main, develop] + branches: [main] workflow_dispatch: permissions: diff --git a/CLAUDE.md b/CLAUDE.md index fbcfee6..aad30d8 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -94,3 +94,16 @@ Invoke the relevant one when the task matches: | `code-review` | Reviewing TypeScript for quality/correctness (`packages/core` + action adapters). | Manage with `npx skills check` / `npx skills update`. + + +## Skills & AI tooling + +**External skills** (lockfile-managed — update with `npx skills check` / `npx skills update`): +- `code-review` — from mattpocock/skills +- `github-actions-docs` — from xixu-me/skills +- `github-actions-templates` — from wshobson/agents +- `receiving-code-review` — from obra/superpowers +- `requesting-code-review` — from obra/superpowers + +**Global tooling available in every session:** lean-ctx (prefer `ctx_*` MCP tools for reads/search/shell — token-compressed), superpowers process skills, and graphify (no graph built for this repo). + diff --git a/skills-lock.json b/skills-lock.json index 215db3e..4887962 100644 --- a/skills-lock.json +++ b/skills-lock.json @@ -13,6 +13,12 @@ "skillPath": "skills/github-actions-docs/SKILL.md", "computedHash": "e9ac24e79715ef3060bd4ae376052f8d863b830604e69cb513b39764bf47ee53" }, + "github-actions-templates": { + "source": "wshobson/agents", + "sourceType": "github", + "skillPath": "plugins/cicd-automation/skills/github-actions-templates/SKILL.md", + "computedHash": "93e92fd674dea084628e95f9c48af806f9672ac08f815c84f85adedb55742c59" + }, "receiving-code-review": { "source": "obra/superpowers", "sourceType": "github",