@1aboveio/skills 0.10.0

package/skills/cicd-pipeline/cloud-deploy/references/config-templates.md

@@ -0,0 +1,257 @@
+# Cloud Deploy Configuration Templates
+
+Load this file when setting up Cloud Deploy pipelines, Skaffold configs, or
+cloudbuild.yaml for a new service. Copy and adapt the templates below.
+
+## clouddeploy.yaml (Two Pipelines)
+
+```yaml
+# =============================================================================
+# DEV PIPELINE (triggered by dev branch)
+# =============================================================================
+apiVersion: deploy.cloud.google.com/v1
+kind: DeliveryPipeline
+metadata:
+  name: {service}-pipeline-dev
+description: {Service} dev pipeline (dev branch → dev env)
+serialPipeline:
+  stages:
+    - targetId: {service}-dev
+      profiles: ["dev"]
+      strategy:
+        standard:
+          predeploy:
+            actions: ["run-migrations"]
+          postdeploy:
+            actions: ["run-seed"]
+          verify: true
+---
+# =============================================================================
+# RELEASE PIPELINE (triggered by master branch)
+# =============================================================================
+apiVersion: deploy.cloud.google.com/v1
+kind: DeliveryPipeline
+metadata:
+  name: {service}-pipeline-release
+description: {Service} release pipeline (master branch → staging → prod)
+serialPipeline:
+  stages:
+    - targetId: {service}-staging
+      profiles: ["staging"]
+      strategy:
+        standard:
+          predeploy:
+            actions: ["run-migrations"]
+          postdeploy:
+            actions: ["run-seed"]
+          verify: true
+    - targetId: {service}-prod
+      profiles: ["prod"]
+      strategy:
+        standard:
+          predeploy:
+            actions: ["run-migrations"]
+          postdeploy:
+            actions: ["run-seed"]
+---
+# =============================================================================
+# TARGETS
+# =============================================================================
+apiVersion: deploy.cloud.google.com/v1
+kind: Target
+metadata:
+  name: {service}-dev
+description: Development environment
+requireApproval: false
+run:
+  location: projects/$PROJECT_ID/locations/$LOCATION
+deployParameters:
+  ENV: "dev"
+---
+apiVersion: deploy.cloud.google.com/v1
+kind: Target
+metadata:
+  name: {service}-staging
+description: Staging environment
+requireApproval: false
+run:
+  location: projects/$PROJECT_ID/locations/$LOCATION
+deployParameters:
+  ENV: "staging"
+---
+apiVersion: deploy.cloud.google.com/v1
+kind: Target
+metadata:
+  name: {service}-prod
+description: Production environment
+requireApproval: false  # Set to true if manual approval needed before prod deploy
+run:
+  location: projects/$PROJECT_ID/locations/$LOCATION
+deployParameters:
+  ENV: "prod"
+```
+
+## cloudbuild.yaml (Single File with Branch Detection)
+
+```yaml
+# GitFlow branching:
+#   - dev branch → {service}-pipeline-dev → dev environment
+#   - master branch → {service}-pipeline-release → staging → prod
+
+substitutions:
+  _FF_API_KEY_SECRET: "ff-api-key"
+  _DATABASE_URL_SECRET_DEV: "database-url-{service}-dev"
+  _DATABASE_URL_SECRET_STAGING: "database-url-{service}-staging"
+  _DATABASE_URL_SECRET_PROD: "database-url-{service}-prod"
+  _VPC_NETWORK_DEV: "default"
+  _VPC_SUBNET_DEV: "default"
+  _VPC_NETWORK_PROD: "prod"
+  _VPC_SUBNET_PROD: "prod"
+
+steps:
+  - id: "test-{service}"
+    # ... unit tests ...
+
+  - id: "build-{service}"
+    # ... docker build ...
+
+  - id: "push-{service}"
+    # ... docker push ...
+
+  # Create jobs based on branch
+  - id: "create-jobs"
+    name: "gcr.io/google.com/cloudsdktool/cloud-sdk"
+    waitFor: ["push-{service}"]
+    entrypoint: "bash"
+    args:
+      - "-c"
+      - |
+        set -e
+        if [ "$BRANCH_NAME" = "dev" ]; then
+          gcloud run jobs deploy {service}-job-dev --image=... --set-env-vars=ENV=dev
+        else
+          gcloud run jobs deploy {service}-job-staging --image=... --set-env-vars=ENV=staging
+          gcloud run jobs deploy {service}-job-prod --image=... --set-env-vars=ENV=prod
+        fi
+
+  - id: "apply-clouddeploy"
+    # ... apply clouddeploy.yaml ...
+
+  # Create release based on branch
+  - id: "create-release"
+    name: "gcr.io/google.com/cloudsdktool/cloud-sdk"
+    waitFor: ["apply-clouddeploy"]
+    entrypoint: "bash"
+    args:
+      - "-c"
+      - |
+        set -e
+
+        # Add timestamp for unique release names on rebuild
+        TIMESTAMP=$$(date +%H%M%S)
+        # Get commit message for release description
+        COMMIT_MSG=$$(git log -1 --pretty=%s | head -c 100)
+
+        if [ "$BRANCH_NAME" = "dev" ]; then
+          PIPELINE="{service}-pipeline-dev"
+          RELEASE_NAME="{service}-dev-${SHORT_SHA}-$$TIMESTAMP"
+        else
+          PIPELINE="{service}-pipeline-release"
+          RELEASE_NAME="{service}-release-${SHORT_SHA}-$$TIMESTAMP"
+        fi
+
+        gcloud deploy releases create "$$RELEASE_NAME" \
+          --delivery-pipeline="$$PIPELINE" \
+          --region=${LOCATION} \
+          --description="$$COMMIT_MSG (branch: $BRANCH_NAME)" \
+          --skaffold-file=skaffold.yaml \
+          --images={service}=${LOCATION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/{service}:${SHORT_SHA}
+```
+
+## skaffold.yaml
+
+```yaml
+apiVersion: skaffold/v4beta11
+kind: Config
+metadata:
+  name: {service}
+build:
+  artifacts:
+    - image: {service}
+      context: .
+      docker:
+        dockerfile: Dockerfile
+deploy:
+  cloudrun:
+    projectid: "{{.PROJECT_ID}}"
+    region: "{{.LOCATION}}"
+customActions:
+  - name: run-migrations
+    containers:
+      - name: migrate
+        image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+        command: ["/bin/sh", "-c"]
+        args: ["gcloud run jobs execute {service}-job-$ENV --args=migrate --region=$CLOUD_DEPLOY_LOCATION --wait"]
+  - name: run-seed
+    containers:
+      - name: seed
+        image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+        command: ["/bin/sh", "-c"]
+        args: ["gcloud run jobs execute {service}-job-$ENV --args=seed --region=$CLOUD_DEPLOY_LOCATION --wait"]
+profiles:
+  - name: dev
+    manifests:
+      kustomize:
+        paths:
+          - deploy/overlays/dev
+    verify:
+      - name: tests
+        container:
+          name: tests
+          image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+          command: ["/bin/sh", "-c"]
+          args: ["gcloud run jobs execute {service}-job-$ENV --args=test --region=$CLOUD_DEPLOY_LOCATION --wait"]
+  - name: staging
+    manifests:
+      kustomize:
+        paths:
+          - deploy/overlays/staging
+    verify:
+      - name: tests
+        container:
+          name: tests
+          image: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
+          command: ["/bin/sh", "-c"]
+          args: ["gcloud run jobs execute {service}-job-$ENV --args=test --region=$CLOUD_DEPLOY_LOCATION --wait"]
+  - name: prod
+    manifests:
+      kustomize:
+        paths:
+          - deploy/overlays/prod
+```
+
+## Cloud Build Triggers Setup
+
+```bash
+# Dev trigger (dev branch → dev env)
+gcloud builds triggers create github \
+  --name="{service}-dev" \
+  --repo-name="REPO_NAME" \
+  --repo-owner="OWNER" \
+  --branch-pattern="^dev$" \
+  --build-config="backend/{service}/cloudbuild.yaml" \
+  --region=$LOCATION
+
+# Release trigger (master branch → staging → prod)
+gcloud builds triggers create github \
+  --name="{service}-release" \
+  --repo-name="REPO_NAME" \
+  --repo-owner="OWNER" \
+  --branch-pattern="^master$" \
+  --build-config="backend/{service}/cloudbuild.yaml" \
+  --region=$LOCATION
+```
+
+Note: Both triggers use the same `cloudbuild.yaml` file. The `$BRANCH_NAME`
+variable is automatically set by Cloud Build to detect which branch triggered
+the build.

package/skills/cicd-pipeline/docker/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO

package/skills/cicd-pipeline/docker/SKILL.md

@@ -0,0 +1,126 @@
+---
+name: docker
+description: Docker/Podman container architecture and build patterns. Read when designing or reviewing containerization, Dockerfile structure, multi-stage builds, PyPI mirror support, or docker-compose setup for Python/uv projects.
+---
+
+# Docker Build Patterns
+
+## Overview
+
+This skill covers Docker build patterns for Python projects using uv, with support for:
+- Multi-stage builds for smaller images
+- PyPI mirror configuration (for China/corporate mirrors)
+- Podman as drop-in replacement for Docker
+- docker-compose integration
+
+## Makefile Pattern
+
+Auto-detect podman or docker, load env vars, and pass build args:
+
+```makefile
+.PHONY: build rebuild
+
+# Auto-detect compose tool (prefer podman-compose, fallback to docker compose)
+COMPOSE_CMD := $(shell command -v podman-compose >/dev/null 2>&1 && echo "podman-compose" || echo "docker compose")
+# Export .env vars for build arg substitution (podman-compose doesn't auto-load .env)
+COMPOSE := set -a && . ./.env && set +a && $(COMPOSE_CMD)
+
+# Auto-detect container build tool (prefer podman, fallback to docker)
+BUILD_CMD := $(shell command -v podman >/dev/null 2>&1 && echo "podman" || echo "docker")
+
+# Load UV_DEFAULT_INDEX from .env for build args
+UV_DEFAULT_INDEX := $(shell grep -E '^UV_DEFAULT_INDEX=' .env 2>/dev/null | cut -d= -f2)
+
+build:  ## Build Docker image
+	$(BUILD_CMD) build --build-arg UV_DEFAULT_INDEX=$(UV_DEFAULT_INDEX) -t app-local:latest .
+
+rebuild:  ## Rebuild Docker image (no cache)
+	$(BUILD_CMD) build --no-cache --build-arg UV_DEFAULT_INDEX=$(UV_DEFAULT_INDEX) -t app-local:latest .
+```
+
+## Dockerfile Pattern (Multi-stage with uv)
+
+```dockerfile
+# Stage 1: Build dependencies
+FROM python:3.12-slim-bookworm AS builder
+
+# PyPI mirror (for China users): e.g., https://mirrors.aliyun.com/pypi/simple/
+ARG UV_DEFAULT_INDEX=
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
+
+WORKDIR /opt/app
+COPY pyproject.toml uv.lock ./
+
+# Install dependencies (creates .venv)
+# If mirror URL provided, create uv.toml with default=true to disable PyPI
+# Note: --frozen uses hardcoded PyPI URLs from lock file, so we omit it when using mirror
+RUN if [ -n "$UV_DEFAULT_INDEX" ]; then \
+      mkdir -p /root/.config/uv && \
+      printf '[[index]]\nurl = "%s"\ndefault = true\n' "$UV_DEFAULT_INDEX" > /root/.config/uv/uv.toml && \
+      echo "Using mirror: $UV_DEFAULT_INDEX" && \
+      cat /root/.config/uv/uv.toml && \
+      uv sync --no-dev; \
+    else \
+      uv sync --frozen --no-dev; \
+    fi
+
+# Stage 2: Runtime
+FROM python:3.12-slim-bookworm
+
+RUN useradd -m -d /opt/app -s /bin/bash app
+WORKDIR /opt/app
+
+# Copy virtual environment from builder
+COPY --from=builder --chown=app:app /opt/app/.venv /opt/app/.venv
+
+ENV PATH="/opt/app/.venv/bin:$PATH"
+USER app
+
+COPY --chown=app:app . .
+```
+
+## docker-compose.yaml Pattern
+
+```yaml
+x-app-common: &app-common
+  image: ${APP_IMAGE:-app-local:latest}
+  build:
+    context: .
+    args:
+      UV_DEFAULT_INDEX: ${UV_DEFAULT_INDEX:-}
+  restart: unless-stopped
+  # ... rest of config
+```
+
+## .env Configuration
+
+```bash
+# PyPI Mirror (for users in China)
+# UV_DEFAULT_INDEX=https://mirrors.aliyun.com/pypi/simple/
+```
+
+## PyPI Mirror: Why `default = true` is Required
+
+`UV_DEFAULT_INDEX` alone doesn't work because:
+1. It's a lower-priority fallback, not a replacement for PyPI
+2. `--frozen` uses hardcoded `files.pythonhosted.org` URLs from `uv.lock`
+
+Solution: Create `uv.toml` with `[[index]]` and `default = true` to completely disable PyPI.
+
+Per [uv docs](https://docs.astral.sh/uv/concepts/indexes/):
+> "marking an index as default will disable the PyPI default index"
+
+## Common Mirrors
+
+| Region | URL |
+|--------|-----|
+| China (Aliyun) | `https://mirrors.aliyun.com/pypi/simple/` |
+| China (Tsinghua) | `https://pypi.tuna.tsinghua.edu.cn/simple/` |
+| China (USTC) | `https://pypi.mirrors.ustc.edu.cn/simple/` |
+
+## Podman Notes
+
+- Podman is a drop-in replacement for Docker (same CLI)
+- `podman-compose` replaces `docker compose`
+- Podman doesn't auto-load `.env` files, hence the `set -a && . ./.env` pattern in Makefile
+- Rootless by default (better security)

package/skills/cicd-pipeline/google-cloud/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO

package/skills/cicd-pipeline/google-cloud/SKILL.md

@@ -0,0 +1,118 @@
+---
+name: google-cloud
+description: >
+  GCP operations covering IAM, IAP, VPC, Secret Manager, Cloud Storage, and
+  project management. Use when configuring GCP resources, managing service
+  accounts, setting up IAP access, configuring VPC networks, managing secrets,
+  or debugging cloud infrastructure.
+---
+
+# Google Cloud Platform (GCP) Skill
+
+Reference hub for GCP operations. Use `$PROJECT_ID`, `$REGION`, and
+`$PROJECT_NUMBER` environment variables throughout — set them for your project.
+
+## Quick Commands
+
+```bash
+# Set default project
+gcloud config set project $PROJECT_ID
+
+# Set default region
+gcloud config set compute/region $REGION
+
+# List enabled APIs
+gcloud services list --enabled --project=$PROJECT_ID
+
+# Describe project
+gcloud projects describe $PROJECT_ID
+```
+
+## Topic Index
+
+Load the relevant reference file based on the task:
+
+| Task | Reference | When to load |
+|------|-----------|--------------|
+| Service accounts, roles, IAP | [references/iam.md](references/iam.md) | Configuring IAM, creating service accounts, granting roles, setting up IAP |
+| VPC, subnets, firewall rules | [references/vpc.md](references/vpc.md) | Setting up VPC networks, subnets, firewall rules, or debugging connectivity |
+| Secret Manager | [references/secrets.md](references/secrets.md) | Creating, accessing, or granting access to secrets |
+| Cloud Storage (GCS) | [references/gcs.md](references/gcs.md) | Managing buckets, objects, lifecycle policies, or GCS IAM |
+| Project metadata, quotas | [references/project.md](references/project.md) | Checking project config, quotas, billing, or API enablement |
+
+## Scripts
+
+Reusable shell scripts in `scripts/`:
+
+| Script | Purpose |
+|--------|---------|
+| `scripts/create-sa.sh` | Create a service account with roles |
+| `scripts/gcp-config.sh` | Set up gcloud default config |
+| `scripts/grant-iap.sh` | Grant IAP access to a user or service account |
+| `scripts/setup-secrets.sh` | Create and populate secrets in Secret Manager |
+
+## Common Patterns
+
+### Service Account Token Minting
+
+```bash
+# Mint ID token for service account
+gcloud iam service-accounts get-openid-token-identity \
+  $SA_EMAIL \
+  --audiences=$AUDIENCE
+
+# Sign JWT with service account
+gcloud iam service-accounts sign-jwt /tmp/claims.json /tmp/signed.jwt \
+  --iam-account=$SA_EMAIL
+```
+
+### VPC Network Lookup
+
+```bash
+# List networks
+gcloud compute networks list
+
+# List subnets in region
+gcloud compute networks subnets list --region=$REGION
+
+# Describe specific subnet
+gcloud compute networks subnets describe $SUBNET --region=$REGION
+```
+
+### Secret Access
+
+```bash
+# List secrets
+gcloud secrets list --project=$PROJECT_ID
+
+# Access latest version
+gcloud secrets versions access latest --secret=$SECRET_NAME
+
+# Grant access to service account
+gcloud secrets add-iam-policy-binding $SECRET \
+  --member="serviceAccount:$SA_EMAIL" \
+  --role="roles/secretmanager.secretAccessor"
+```
+
+### GCS Operations
+
+```bash
+# List buckets
+gcloud storage buckets list --project=$PROJECT_ID
+
+# Upload / download / copy
+gcloud storage cp file.txt gs://$BUCKET_NAME/
+gcloud storage cp gs://$BUCKET_NAME/file.txt ./
+gcloud storage cp gs://$BUCKET_A/file.txt gs://$BUCKET_B/
+
+# Set IAM on bucket
+gcloud storage buckets add-iam-policy-binding gs://$BUCKET_NAME \
+  --member="serviceAccount:$SA_EMAIL" \
+  --role="roles/storage.objectViewer"
+```
+
+## Related Skills
+
+- [cloud-build](../cloud-build/SKILL.md) — Cloud Build → Cloud Run deployments
+- [cloud-deploy](../cloud-deploy/SKILL.md) — Cloud Deploy + Skaffold pipelines
+- [cloud-debug](../cloud-debug/SKILL.md) — Debugging Cloud Build/Deploy failures