@hybridlabor-api/aos 4.8.0 → 4.10.0

package/skills/global_config/github-actions-generator/assets/templates/workflow/basic_workflow.yml

@@ -0,0 +1,242 @@
+# [WORKFLOW_NAME]
+#
+# [WORKFLOW_DESCRIPTION]
+#
+# Triggers:
+#   - [TRIGGER_EVENTS]
+#
+# Required secrets:
+#   - [SECRET_NAME]: [SECRET_DESCRIPTION]
+#
+# Required permissions:
+#   - [PERMISSION_SCOPE]: [read/write]
+
+name: [WORKFLOW_NAME]
+
+on:
+  # Trigger on push to specific branches
+  push:
+    branches: [main, develop]
+    paths:
+      - '[PATH_PATTERN]/**'
+      - '!**.md'
+
+  # Trigger on pull requests
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened]
+
+  # Manual trigger
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Environment to deploy'
+        required: true
+        type: choice
+        options:
+          - dev
+          - staging
+          - production
+        default: 'dev'
+      debug:
+        description: 'Enable debug mode'
+        required: false
+        type: boolean
+        default: false
+
+  # Scheduled trigger (daily at 2 AM UTC)
+  schedule:
+    - cron: '0 2 * * *'
+
+# Set default permissions to read-only (security best practice)
+permissions:
+  contents: read
+
+# Prevent duplicate runs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# Environment variables available to all jobs
+env:
+  [ENV_VAR_NAME]: '[ENV_VAR_VALUE]'
+
+jobs:
+  # Job 1: Linting and validation
+  lint:
+    name: Lint and Validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+
+      - name: [SETUP_STEP_NAME]
+        uses: [SETUP_ACTION]
+        with:
+          [SETUP_INPUT]: [SETUP_VALUE]
+          cache: '[CACHE_TYPE]'
+
+      - name: Install dependencies
+        run: [INSTALL_COMMAND]
+
+      - name: Run linter
+        run: [LINT_COMMAND]
+
+  # Job 2: Testing
+  test:
+    name: Test on [PLATFORM] [VERSION]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+
+    permissions:
+      contents: read
+      checks: write  # For test reporting
+
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        [VERSION_KEY]: [[VERSION_1], [VERSION_2], [VERSION_3]]
+        exclude:
+          # Exclude expensive combinations if needed
+          - os: macos-latest
+            [VERSION_KEY]: [VERSION_1]
+      fail-fast: false
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: "[SETUP_STEP_NAME] ${{ matrix.[VERSION_KEY] }}"
+        uses: [SETUP_ACTION]
+        with:
+          [VERSION_INPUT]: ${{ matrix.[VERSION_KEY] }}
+          cache: '[CACHE_TYPE]'
+
+      - name: Install dependencies
+        run: [INSTALL_COMMAND]
+
+      - name: Run tests
+        run: [TEST_COMMAND]
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        with:
+          name: test-results-${{ matrix.os }}-${{ matrix.[VERSION_KEY] }}
+          path: [TEST_RESULTS_PATH]
+          retention-days: 7
+
+      - name: Upload coverage
+        if: matrix.os == 'ubuntu-latest' && matrix.[VERSION_KEY] == [MAIN_VERSION]
+        uses: codecov/codecov-action@e0b68c6749509c5f83f984dd99a76a1c1a231044 # v4.0.1
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: [COVERAGE_FILE_PATH]
+          fail_ci_if_error: true
+
+  # Job 3: Build
+  build:
+    name: Build Application
+    needs: [lint, test]
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    permissions:
+      contents: read
+
+    outputs:
+      build-id: ${{ steps.build.outputs.id }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: [SETUP_STEP_NAME]
+        uses: [SETUP_ACTION]
+        with:
+          [SETUP_INPUT]: [SETUP_VALUE]
+          cache: '[CACHE_TYPE]'
+
+      - name: Install dependencies
+        run: [INSTALL_COMMAND]
+
+      - name: Build application
+        id: build
+        run: |
+          [BUILD_COMMAND]
+          echo "id=build-${{ github.sha }}" >> $GITHUB_OUTPUT
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+        with:
+          name: build-${{ github.sha }}
+          path: [BUILD_OUTPUT_PATH]
+          retention-days: 7
+          if-no-files-found: error
+
+  # Job 4: Deploy (conditional)
+  deploy:
+    name: Deploy to [ENVIRONMENT]
+    needs: build
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    # Use environment for deployment protection rules
+    environment:
+      name: [ENVIRONMENT_NAME]
+      url: [ENVIRONMENT_URL]
+
+    permissions:
+      contents: read
+      deployments: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
+        with:
+          name: build-${{ github.sha }}
+          path: [BUILD_OUTPUT_PATH]
+
+      - name: Deploy to [ENVIRONMENT]
+        env:
+          [DEPLOY_SECRET]: ${{ secrets.[DEPLOY_SECRET] }}
+        run: |
+          [DEPLOY_COMMAND]
+
+      - name: Verify deployment
+        run: |
+          [VERIFICATION_COMMAND]
+
+      - name: Notify on failure
+        if: failure()
+        run: |
+          echo "Deployment failed!"
+          # Add notification logic here
+
+  # Job 5: Cleanup (always runs)
+  cleanup:
+    name: Cleanup
+    needs: [deploy]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Cleanup temporary resources
+        run: |
+          echo "Performing cleanup..."
+          # Add cleanup logic here

package/skills/global_config/github-actions-generator/assets/templates/workflow/reusable_workflow.yml

@@ -0,0 +1,106 @@
+# [REUSABLE_WORKFLOW_NAME]
+#
+# [WORKFLOW_DESCRIPTION]
+#
+# Inputs:
+#   - [INPUT_NAME]: [INPUT_DESCRIPTION]
+#
+# Secrets:
+#   - [SECRET_NAME]: [SECRET_DESCRIPTION]
+#
+# Outputs:
+#   - [OUTPUT_NAME]: [OUTPUT_DESCRIPTION]
+#
+# Usage:
+#   jobs:
+#     call-workflow:
+#       uses: [OWNER]/[REPO]/.github/workflows/[FILENAME]@[REF]
+#       with:
+#         [INPUT_NAME]: [INPUT_VALUE]
+#       secrets:
+#         [SECRET_NAME]: ${{ secrets.[SECRET_NAME] }}
+
+name: [REUSABLE_WORKFLOW_NAME]
+
+on:
+  workflow_call:
+    inputs:
+      [INPUT_NAME]:
+        description: '[INPUT_DESCRIPTION]'
+        required: [true/false]
+        type: [string/boolean/number/choice/environment]
+        default: '[DEFAULT_VALUE]'  # Optional, only for optional inputs
+
+      # Add more inputs as needed
+      # Example types:
+      # - string: text values
+      # - boolean: true/false
+      # - number: numeric values
+      # - choice: predefined options (requires 'options' field)
+      # - environment: GitHub environment name
+
+    secrets:
+      [SECRET_NAME]:
+        description: '[SECRET_DESCRIPTION]'
+        required: [true/false]
+
+      # Add more secrets as needed
+      # Alternatively, use 'secrets: inherit' to pass all secrets
+      # (use sparingly for security)
+
+    outputs:
+      [OUTPUT_NAME]:
+        description: '[OUTPUT_DESCRIPTION]'
+        value: ${{ jobs.[JOB_ID].outputs.[OUTPUT_KEY] }}
+
+      # Add more outputs as needed
+      # Outputs must be mapped from job outputs
+
+# Set default permissions (security best practice)
+permissions:
+  contents: read
+
+# Environment variables available to all jobs
+env:
+  [ENV_VAR_NAME]: '[ENV_VAR_VALUE]'
+
+jobs:
+  [JOB_ID]:
+    name: [JOB_NAME]
+    runs-on: [ubuntu-latest/windows-latest/macos-latest]
+    timeout-minutes: [TIMEOUT_MINUTES]
+
+    # Job-specific permissions
+    permissions:
+      contents: read
+      [PERMISSION_SCOPE]: [read/write]
+
+    # Define outputs for this job
+    outputs:
+      [OUTPUT_KEY]: ${{ steps.[STEP_ID].outputs.[OUTPUT_NAME] }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+
+      - name: [STEP_NAME]
+        id: [STEP_ID]
+        run: |
+          # Use inputs: ${{ inputs.[INPUT_NAME] }}
+          # Use secrets: ${{ secrets.[SECRET_NAME] }}
+          echo "[OUTPUT_NAME]=[OUTPUT_VALUE]" >> $GITHUB_OUTPUT
+
+      # Add more steps as needed
+
+  # Add more jobs as needed
+  [ANOTHER_JOB_ID]:
+    name: [ANOTHER_JOB_NAME]
+    needs: [JOB_ID]  # Optional: depend on previous job
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Use previous job output
+        run: |
+          echo "Output from previous job: ${{ needs.[JOB_ID].outputs.[OUTPUT_KEY] }}"

package/skills/global_config/github-actions-generator/examples/README.md

@@ -0,0 +1,147 @@
+# GitHub Actions Generator Examples
+
+This directory contains example workflows and actions generated using the github-actions-generator skill.
+
+## Workflows
+
+### Language-Specific CI Pipelines
+
+#### nodejs-ci.yml
+Complete CI pipeline for Node.js applications demonstrating:
+- Matrix testing across multiple Node.js versions and operating systems
+- Dependency caching with `actions/setup-node`
+- Parallel linting and testing
+- Artifact uploading for test results
+- Code coverage reporting with Codecov
+- Concurrency controls
+
+**Use case:** Standard CI/CD for Node.js projects
+
+#### python-ci.yml
+Python CI pipeline demonstrating:
+- Matrix testing across Python versions
+- Virtual environment management
+- Dependency caching with pip
+- Testing with pytest
+- Code quality checks
+
+**Use case:** Python application CI/CD
+
+#### go-ci.yml
+Go CI pipeline demonstrating:
+- Go module caching
+- Cross-platform builds
+- Go testing and benchmarking
+- Static code analysis
+
+**Use case:** Go application CI/CD
+
+### Container & Deployment Workflows
+
+#### docker-build-push.yml
+Docker image build and push workflow demonstrating:
+- Multi-platform builds (amd64, arm64)
+- GitHub Container Registry integration
+- Docker layer caching with GitHub Actions cache
+- Automatic tagging based on git events
+- Secure authentication with `GITHUB_TOKEN`
+
+**Use case:** Containerized application deployment
+
+#### multi-environment-deploy.yml
+Multi-environment deployment workflow demonstrating:
+- Environment protection rules and approval gates
+- Dynamic environment selection (dev, staging, production)
+- AWS deployment with OIDC authentication
+- Blue-green deployment strategy
+- Automatic rollback on failure
+- Smoke tests and health checks
+- Deployment verification
+
+**Use case:** Production-grade multi-stage deployments
+
+### Advanced Workflow Patterns
+
+#### monorepo-ci.yml
+Monorepo CI pipeline demonstrating:
+- Path-based change detection
+- Conditional job execution based on affected packages
+- Cross-package dependency management
+- Parallel builds for independent packages
+- Artifact sharing between jobs
+- Package-specific test strategies
+
+**Use case:** Monorepo projects with multiple packages
+
+#### scheduled-tasks.yml
+Scheduled maintenance workflow demonstrating:
+- Cron schedule configuration
+- Dependency security audits
+- Stale branch cleanup
+- Cache management
+- External service health checks
+- Automated issue creation
+- Weekly metrics reporting
+
+**Use case:** Repository maintenance and monitoring
+
+### Security Workflows
+
+#### security/dependency-review.yml
+Dependency review workflow demonstrating:
+- Pull request dependency scanning
+- Vulnerability severity thresholds
+- License policy enforcement
+- Automatic build failure on policy violations
+
+**Use case:** Supply chain security for PRs
+
+#### security/sbom-attestation.yml
+SBOM and attestation workflow demonstrating:
+- Software Bill of Materials generation
+- SBOM attestation with GitHub's signing infrastructure
+- Build provenance attestation
+- Container vulnerability scanning with Trivy
+- Multi-platform container builds
+- Security scan results upload to GitHub Security tab
+
+**Use case:** Supply chain security compliance
+
+## Actions
+
+### setup-node-cached/action.yml
+Composite action for Node.js setup demonstrating:
+- Smart dependency caching for npm, yarn, and pnpm
+- Input validation
+- Multiple package manager support
+- Cache hit detection
+- Grouped output for better logging
+
+**Use case:** Reusable Node.js setup across multiple workflows
+
+## Usage
+
+These examples can be used as:
+1. **Templates** - Copy and modify for your own projects
+2. **Learning Resources** - Study best practices and patterns
+3. **Testing** - Validate with github-actions-validator skill
+
+## Testing Examples
+
+To validate any of these examples:
+
+```bash
+cd devops-skills-plugin/skills/github-actions-validator
+bash scripts/validate_workflow.sh ../../github-actions-generator/examples/workflows/nodejs-ci.yml
+```
+
+## Best Practices Demonstrated
+
+All examples follow these best practices:
+- ✅ Actions pinned to SHAs with version comments
+- ✅ Minimal permissions with explicit `permissions:` blocks
+- ✅ Concurrency controls to prevent duplicate runs
+- ✅ Proper timeout settings
+- ✅ Semantic naming conventions
+- ✅ Comprehensive error handling
+- ✅ Security-first approach

package/skills/global_config/github-actions-generator/examples/actions/setup-node-cached/action.yml

@@ -0,0 +1,93 @@
+name: 'Setup Node.js with Smart Caching'
+description: 'Setup Node.js with intelligent dependency caching and installation'
+author: 'Example Author'
+
+inputs:
+  node-version:
+    description: 'Node.js version to use'
+    required: true
+  package-manager:
+    description: 'Package manager to use (npm, yarn, pnpm)'
+    required: false
+    default: 'npm'
+  cache-dependency-path:
+    description: 'Path to lock file(s)'
+    required: false
+    default: '**/package-lock.json'
+
+outputs:
+  cache-hit:
+    description: 'Whether cache was hit'
+    value: ${{ steps.cache.outputs.cache-hit }}
+  node-version:
+    description: 'Actual Node.js version installed'
+    value: ${{ steps.setup.outputs.node-version }}
+
+branding:
+  icon: 'package'
+  color: 'green'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Validate inputs
+      shell: bash
+      run: |
+        if [[ ! "${{ inputs.package-manager }}" =~ ^(npm|yarn|pnpm)$ ]]; then
+          echo "::error::Invalid package manager: ${{ inputs.package-manager }}"
+          exit 1
+        fi
+        echo "✅ Inputs validated"
+
+    - name: Setup Node.js ${{ inputs.node-version }}
+      id: setup
+      uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+      with:
+        node-version: ${{ inputs.node-version }}
+
+    - name: Enable Corepack for pnpm/yarn
+      if: inputs.package-manager != 'npm'
+      shell: bash
+      run: corepack enable
+
+    - name: Get cache directory
+      id: cache-dir
+      shell: bash
+      run: |
+        if [ "${{ inputs.package-manager }}" == "npm" ]; then
+          echo "dir=$(npm config get cache)" >> $GITHUB_OUTPUT
+        elif [ "${{ inputs.package-manager }}" == "yarn" ]; then
+          echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
+        else
+          echo "dir=$(pnpm store path)" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Cache dependencies
+      id: cache
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      with:
+        path: ${{ steps.cache-dir.outputs.dir }}
+        key: ${{ runner.os }}-${{ inputs.package-manager }}-${{ hashFiles(inputs.cache-dependency-path) }}
+        restore-keys: |
+          ${{ runner.os }}-${{ inputs.package-manager }}-
+
+    - name: Install dependencies
+      if: steps.cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        if [ "${{ inputs.package-manager }}" == "npm" ]; then
+          npm ci
+        elif [ "${{ inputs.package-manager }}" == "yarn" ]; then
+          yarn install --frozen-lockfile
+        else
+          pnpm install --frozen-lockfile
+        fi
+
+    - name: Report status
+      shell: bash
+      run: |
+        echo "::group::Setup Summary"
+        echo "Node.js version: $(node --version)"
+        echo "Package manager: ${{ inputs.package-manager }}"
+        echo "Cache hit: ${{ steps.cache.outputs.cache-hit }}"
+        echo "::endgroup::"