@cubis/foundry 0.3.10

package/Ai Agent Workflow/skills/devops-engineer/references/deployment-strategies.md

@@ -0,0 +1,244 @@
+# Deployment Strategies
+
+> Reference for: DevOps Engineer
+> Load when: Deployment strategy, rollback, blue-green, canary releases
+
+## Strategy Comparison
+
+| Strategy | Use When | Rollback | Risk |
+|----------|----------|----------|------|
+| **Rolling** | Standard updates, can tolerate mixed versions | Automatic via health checks | Low |
+| **Blue-Green** | Zero downtime, instant rollback needed | Switch traffic to old env | Medium |
+| **Canary** | Risk mitigation, gradual rollout | Scale down canary | Low |
+| **Recreate** | Stateful apps, breaking changes | Redeploy previous version | High |
+
+## Rolling Deployment (Kubernetes)
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+spec:
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%        # Max pods above desired
+      maxUnavailable: 25%  # Max pods unavailable
+```
+
+## Blue-Green with Ingress
+
+```yaml
+# Blue deployment (current)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app-blue
+  labels:
+    version: blue
+---
+# Green deployment (new)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app-green
+  labels:
+    version: green
+---
+# Service pointing to active version
+apiVersion: v1
+kind: Service
+metadata:
+  name: app
+spec:
+  selector:
+    version: blue  # Switch to 'green' for cutover
+```
+
+## Canary with Istio
+
+```yaml
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: app
+spec:
+  hosts:
+    - app
+  http:
+    - match:
+        - headers:
+            canary:
+              exact: "true"
+      route:
+        - destination:
+            host: app-canary
+    - route:
+        - destination:
+            host: app-stable
+          weight: 90
+        - destination:
+            host: app-canary
+          weight: 10
+```
+
+## Rollback Procedures
+
+### Kubernetes Rollback
+```bash
+# View rollout history
+kubectl rollout history deployment/app
+
+# Rollback to previous
+kubectl rollout undo deployment/app
+
+# Rollback to specific revision
+kubectl rollout undo deployment/app --to-revision=2
+
+# Check status
+kubectl rollout status deployment/app
+```
+
+### ArgoCD Rollback
+```bash
+argocd app rollback app-prod --revision=123
+```
+
+### Terraform Rollback
+```bash
+# Identify previous state
+terraform state list
+
+# Import previous configuration
+git checkout HEAD~1 -- main.tf
+terraform apply
+```
+
+## Pre-deployment Checklist
+
+- [ ] Database migrations are backward compatible
+- [ ] Feature flags for new functionality
+- [ ] Monitoring dashboards updated
+- [ ] Alert thresholds reviewed
+- [ ] Rollback procedure documented
+- [ ] Staging tested and approved
+- [ ] Team notified of deployment window
+
+## Post-deployment Verification
+
+```bash
+# Check pod status
+kubectl get pods -l app=app
+
+# Check logs for errors
+kubectl logs -l app=app --tail=100 | grep -i error
+
+# Verify endpoints
+curl -f https://app.example.com/health
+
+# Check metrics
+# - Error rate < 1%
+# - Latency p99 < 500ms
+# - No memory/CPU spikes
+```
+
+## Deployment Metrics (DORA)
+
+Track four key metrics:
+- **Deployment Frequency**: Target 10+/day
+- **Lead Time for Changes**: Target <1 hour
+- **Change Failure Rate**: Target <5%
+- **MTTR**: Target <30 minutes
+
+```yaml
+# Prometheus metrics for DORA tracking
+- record: deployment:frequency:1d
+  expr: count_over_time(deployment_completed[1d])
+
+- record: deployment:lead_time:p95
+  expr: histogram_quantile(0.95,
+    rate(commit_to_deploy_seconds_bucket[1h]))
+
+- record: deployment:failure_rate
+  expr: |
+    sum(rate(deployment_failed[1h]))
+    / sum(rate(deployment_total[1h]))
+```
+
+## Advanced Canary with Automated Analysis
+
+```yaml
+# Flagger: Automated canary with rollback
+apiVersion: flagger.app/v1beta1
+kind: Canary
+metadata:
+  name: api
+spec:
+  provider: istio
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: api
+  progressDeadlineSeconds: 60
+  service:
+    port: 8080
+    trafficPolicy:
+      tls:
+        mode: ISTIO_MUTUAL
+  analysis:
+    interval: 30s
+    threshold: 5
+    maxWeight: 50
+    stepWeight: 10
+    metrics:
+      - name: error-rate
+        templateRef:
+          name: error-rate
+        thresholdRange:
+          max: 1
+      - name: latency
+        templateRef:
+          name: latency
+        thresholdRange:
+          max: 500
+    webhooks:
+      - name: acceptance-test
+        type: pre-rollout
+        url: http://test-runner/
+      - name: load-test
+        url: http://loadtester/
+        timeout: 5s
+        metadata:
+          type: bash
+          cmd: "hey -z 1m -q 10 http://api-canary:8080/"
+```
+
+## Shadow Deployment
+
+```yaml
+# Mirror traffic to shadow deployment
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: api
+spec:
+  hosts:
+    - api
+  http:
+    - match:
+        - headers:
+            x-test-version:
+              exact: "v2"
+      route:
+        - destination:
+            host: api
+            subset: v2
+      mirror:
+        host: api
+        subset: v2-shadow
+      mirrorPercentage:
+        value: 100
+    - route:
+        - destination:
+            host: api
+            subset: v1
+```

package/Ai Agent Workflow/skills/devops-engineer/references/docker-patterns.md

@@ -0,0 +1,193 @@
+# Docker Patterns
+
+> Reference for: DevOps Engineer
+> Load when: Containerizing applications, writing Dockerfiles, Docker security
+
+## Multi-stage Dockerfile (Bun - Recommended)
+
+```dockerfile
+# Build stage
+FROM oven/bun:1.3 AS builder
+WORKDIR /app
+COPY package.json bun.lockb ./
+RUN bun install --frozen-lockfile
+COPY . .
+RUN bun run build
+
+# Production stage
+FROM oven/bun:1.3-slim AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+RUN addgroup -g 1001 -S bunjs && adduser -S bunjs -u 1001 -G bunjs
+COPY --from=builder --chown=bunjs:bunjs /app/dist ./dist
+COPY --from=builder --chown=bunjs:bunjs /app/node_modules ./node_modules
+COPY --from=builder --chown=bunjs:bunjs /app/package.json ./
+USER bunjs
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
+  CMD bun -e "fetch('http://localhost:3000/health').then(r => process.exit(r.ok ? 0 : 1))"
+CMD ["bun", "run", "dist/main.js"]
+```
+
+## Multi-stage Dockerfile (Node.js - Legacy)
+
+```dockerfile
+# Build stage
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --only=production && npm cache clean --force
+COPY . .
+RUN npm run build
+
+# Production stage
+FROM node:20-alpine AS runner
+WORKDIR /app
+ENV NODE_ENV=production
+RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001
+COPY --from=builder --chown=nodejs:nodejs /app/dist ./dist
+COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
+USER nodejs
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
+  CMD wget -qO- http://localhost:3000/health || exit 1
+CMD ["node", "dist/main.js"]
+```
+
+## Multi-stage Dockerfile (Python)
+
+```dockerfile
+FROM python:3.12-slim AS builder
+WORKDIR /app
+RUN pip install --no-cache-dir poetry
+COPY pyproject.toml poetry.lock ./
+RUN poetry export -f requirements.txt --output requirements.txt
+RUN pip wheel --no-cache-dir --wheel-dir /wheels -r requirements.txt
+
+FROM python:3.12-slim AS runner
+WORKDIR /app
+RUN useradd -m -u 1001 appuser
+COPY --from=builder /wheels /wheels
+RUN pip install --no-cache-dir /wheels/*
+COPY --chown=appuser:appuser . .
+USER appuser
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=3s \
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"
+CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]
+```
+
+## Docker Compose (Development with Bun)
+
+```yaml
+version: "3.8"
+services:
+  app:
+    build:
+      context: .
+      target: builder
+    volumes:
+      - .:/app
+      - /app/node_modules
+    ports:
+      - "3000:3000"
+    environment:
+      - MONGO_URL=mongodb://mongo:27017/oneup
+      - SESSION_SECRET=${SESSION_SECRET}
+      - NODE_ENV=development
+    depends_on:
+      mongo:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    command: bun run --watch src/main.ts
+
+  mongo:
+    image: mongo:7
+    ports:
+      - "27017:27017"
+    volumes:
+      - mongo_data:/data/db
+    healthcheck:
+      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  redis:
+    image: redis:7-alpine
+    ports:
+      - "6379:6379"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  mongo_data:
+```
+
+## Docker Compose (Legacy Node.js)
+
+```yaml
+version: "3.8"
+services:
+  app:
+    build:
+      context: .
+      target: builder # Use dev stage
+    volumes:
+      - .:/app
+      - /app/node_modules
+    ports:
+      - "3000:3000"
+    environment:
+      - DATABASE_URL=postgres://user:pass@db:5432/app
+    depends_on:
+      db:
+        condition: service_healthy
+
+  db:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: user
+      POSTGRES_PASSWORD: pass
+      POSTGRES_DB: app
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U user -d app"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  postgres_data:
+```
+
+## Security Best Practices
+
+| Practice            | Implementation                          |
+| ------------------- | --------------------------------------- |
+| Non-root user       | `USER nodejs` or `USER 1001`            |
+| Minimal base image  | Use `-alpine` or `-slim` variants       |
+| No secrets in image | Use runtime env vars or secrets         |
+| Pin versions        | `FROM node:20.10.0-alpine` not `latest` |
+| Scan images         | `docker scout`, `trivy`, `snyk`         |
+| Health checks       | `HEALTHCHECK` instruction               |
+| .dockerignore       | Exclude `node_modules`, `.git`, `.env`  |
+
+## .dockerignore Template
+
+```
+node_modules
+.git
+.env*
+*.md
+Dockerfile*
+docker-compose*
+.dockerignore
+coverage
+.nyc_output
+```

package/Ai Agent Workflow/skills/devops-engineer/references/github-actions.md

@@ -0,0 +1,142 @@
+# GitHub Actions Pipelines
+
+> Reference for: DevOps Engineer
+> Load when: Setting up CI/CD, GitHub workflows, pipelines
+
+## Complete CI/CD Pipeline
+
+```yaml
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm test
+      - run: npm run lint
+
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      image-tag: ${{ steps.meta.outputs.tags }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha,prefix=
+            type=ref,event=branch
+      - uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  deploy-staging:
+    needs: build
+    if: github.ref == 'refs/heads/develop'
+    runs-on: ubuntu-latest
+    environment: staging
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          kubectl set image deployment/app app=${{ needs.build.outputs.image-tag }}
+
+  deploy-production:
+    needs: build
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          kubectl set image deployment/app app=${{ needs.build.outputs.image-tag }}
+```
+
+## Common Workflow Patterns
+
+### Matrix Builds (Multi-version testing)
+```yaml
+jobs:
+  test:
+    strategy:
+      matrix:
+        node-version: [18, 20, 22]
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+```
+
+### Reusable Workflows
+```yaml
+# .github/workflows/deploy.yml
+on:
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        type: string
+    secrets:
+      DEPLOY_KEY:
+        required: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    steps:
+      - run: echo "Deploying to ${{ inputs.environment }}"
+```
+
+### Caching Dependencies
+```yaml
+- uses: actions/cache@v4
+  with:
+    path: ~/.npm
+    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+    restore-keys: |
+      ${{ runner.os }}-node-
+```
+
+## Quick Reference
+
+| Action | Purpose |
+|--------|---------|
+| `actions/checkout@v4` | Clone repository |
+| `actions/setup-node@v4` | Install Node.js |
+| `docker/build-push-action@v5` | Build and push Docker image |
+| `docker/metadata-action@v5` | Generate Docker tags |
+| `actions/cache@v4` | Cache dependencies |