@jetrabbits/agentic 0.0.1

package/areas/devops/devsecops/prompts/security-scan-pipeline.md

@@ -0,0 +1,131 @@
+---
+workflow: security-scan-pipeline
+---
+
+# Prompt: `/security-scan-pipeline`
+
+Use when: running a release-blocking security scan pipeline or remediating findings across secrets, containers, dependencies, and SBOM/signing controls.
+
+---
+
+## Example 1 — Full pre-release security scan
+
+**EN:**
+```
+/security-scan-pipeline
+
+Service: payment-service / Version: v2.5.0
+Scope: full scan (code, dependencies, image, IaC)
+Pipeline stage: pre-release gate
+Scans to run:
+  1. SAST: semgrep (ruleset: python, owasp) on src/
+  2. Dependency CVE: trivy fs . (CRITICAL+HIGH block)
+  3. Secrets: trufflehog git --since-commit HEAD~10
+  4. Image: trivy image registry.internal/payment-service:v2.5.0 (CRITICAL+HIGH block)
+  5. IaC: tfsec terraform/ (CRITICAL+HIGH block)
+  6. SBOM: generate CycloneDX from image; attach via cosign
+Expected output: pass/fail per scan + finding summary + exceptions list
+Block release if: any unresolved Critical/High without approved exception
+```
+
+**RU:**
+```
+/security-scan-pipeline
+
+Сервис: payment-service / Версия: v2.5.0
+Скоуп: полное сканирование (код, зависимости, образ, IaC)
+Стадия pipeline: pre-release gate
+Сканирования:
+  1. SAST: semgrep (ruleset: python, owasp) на src/
+  2. CVE зависимостей: trivy fs . (CRITICAL+HIGH блокируют)
+  3. Секреты: trufflehog git --since-commit HEAD~10
+  4. Образ: trivy image registry.internal/payment-service:v2.5.0 (CRITICAL+HIGH блокируют)
+  5. IaC: tfsec terraform/ (CRITICAL+HIGH блокируют)
+  6. SBOM: генерация CycloneDX из образа; прикрепление через cosign
+Ожидаемый результат: pass/fail по каждому скану + сводка находок + список исключений
+Блокировать релиз если: есть неразрешённые Critical/High без утверждённого исключения
+```
+
+---
+
+## Example 2 — Harden existing Python service Dockerfile
+
+**EN:**
+```
+/security-scan-pipeline
+
+Service: notification-service / Language: Python 3.12 + FastAPI
+Current Dockerfile issues (from Trivy + OPA scan):
+  - Runs as root (no USER instruction)
+  - Base image: python:3.12 (full, not slim; 800MB with dev tools)
+  - No multi-stage (test deps included in production image)
+  - Base image tag not pinned to digest
+  - COPY . . copies .env and .git into image
+Hardening targets:
+  1. Distroless or python:3.12-slim@sha256:<digest> base (< 150MB final)
+  2. Non-root user (UID 1000)
+  3. Multi-stage: builder with pip install; runtime with only app + deps
+  4. .dockerignore: exclude .env, .git, tests/, __pycache__, *.pyc
+  5. readOnlyRootFilesystem: true in K8s (mount emptyDir for /tmp)
+  6. drop ALL capabilities; no privilege escalation
+Show: before/after Dockerfile + Helm values securityContext patch
+```
+
+**RU:**
+```
+/security-scan-pipeline
+
+Сервис: notification-service / Язык: Python 3.12 + FastAPI
+Текущие проблемы Dockerfile (из Trivy + OPA скана):
+  - Запуск от root (нет инструкции USER)
+  - Base image: python:3.12 (полный, не slim; 800MB с dev tools)
+  - Нет multi-stage (зависимости для тестов включены в production образ)
+  - Тег base image не закреплён с digest
+  - COPY . . копирует .env и .git в образ
+Цели hardening:
+  1. Distroless или python:3.12-slim@sha256:<digest> база (финальный < 150MB)
+  2. Не-root пользователь (UID 1000)
+  3. Multi-stage: builder с pip install; runtime только с приложением + зависимостями
+  4. .dockerignore: исключить .env, .git, tests/, __pycache__, *.pyc
+  5. readOnlyRootFilesystem: true в K8s (монтировать emptyDir для /tmp)
+  6. drop ALL capabilities; без повышения привилегий
+Показать: Dockerfile до/после + патч securityContext в Helm values
+```
+
+---
+
+## Example 3 — Add SBOM + cosign to existing pipeline
+
+**EN:**
+```
+/security-scan-pipeline
+
+Service: payment-service / CI: GitHub Actions
+Image: ghcr.io/myorg/payment-service:${{ github.sha }}
+Current state: image built and pushed; no SBOM, no signature
+Add to pipeline (after image push step):
+  1. Generate SBOM in CycloneDX format using Syft
+  2. Attach SBOM to image in OCI registry using cosign attach sbom
+  3. Sign image with cosign using GitHub OIDC (keyless — no private key management)
+  4. Generate SLSA provenance attestation (via docker/build-push-action provenance:true)
+  5. Add verification step in deploy job: cosign verify before helm upgrade
+  6. Store SBOM as build artifact (for audit/compliance download)
+Show: complete GitHub Actions steps to insert after existing push step
+```
+
+**RU:**
+```
+/security-scan-pipeline
+
+Сервис: payment-service / CI: GitHub Actions
+Образ: ghcr.io/myorg/payment-service:${{ github.sha }}
+Текущее состояние: образ собирается и пушится; без SBOM, без подписи
+Добавить в pipeline (после шага push образа):
+  1. Генерация SBOM в формате CycloneDX через Syft
+  2. Прикрепление SBOM к образу в OCI registry через cosign attach sbom
+  3. Подпись образа через cosign с GitHub OIDC (keyless — без управления приватным ключом)
+  4. Генерация SLSA provenance attestation (через docker/build-push-action provenance:true)
+  5. Добавить шаг верификации в deploy job: cosign verify перед helm upgrade
+  6. Сохранить SBOM как build artifact (для загрузки при аудите/compliance)
+Показать: полные шаги GitHub Actions для вставки после существующего шага push
+```

package/areas/devops/devsecops/rules/container-security.md

@@ -0,0 +1,22 @@
+# Rule: Container Security Standards
+
+**Priority**: P0 — Containers violating these standards are rejected at deploy time via policy.
+
+## Dockerfile Standards
+
+1. **Non-root user** — `USER 1000:1000` in Dockerfile; never run as root.
+2. **Minimal base image** — prefer distroless or Alpine; never `FROM ubuntu:latest`.
+3. **Pin base image to digest** — `FROM python:3.12-slim@sha256:...` (not tag-only).
+4. **No secrets in layers** — no `COPY .env`, no `ARG password=`; multi-stage to exclude build secrets.
+5. **No SETUID binaries** — `RUN find / -perm /6000 -type f -exec chmod a-s {} \;`
+6. **Read-only filesystem** where possible — `readOnlyRootFilesystem: true` in pod spec.
+
+## K8s Admission Policy (OPA/Gatekeeper or Kyverno)
+
+Blocked at admission:
+- `privileged: true` containers in production namespace
+- `runAsRoot: true` or missing `runAsNonRoot`
+- `allowPrivilegeEscalation: true`
+- Missing `resources.requests` / `resources.limits`
+- Image without digest (`:latest` or mutable tag)
+- Unsigned images (if cosign policy enabled)

package/areas/devops/devsecops/rules/policy-as-code.md

@@ -0,0 +1,37 @@
+# Rule: Policy as Code
+
+**Priority**: P1 — Security policies enforced as admission controllers, not documentation.
+
+## OPA/Gatekeeper vs Kyverno
+
+| | OPA/Gatekeeper | Kyverno |
+|:---|:---|:---|
+| Language | Rego | YAML/JMESPath |
+| Learning curve | Higher | Lower |
+| Best for | Complex logic, cross-resource | Simple K8s guardrails |
+| Mutation | Limited | Built-in |
+
+## Policy Categories
+
+1. **Validation** — reject non-compliant resources (privilege escalation, missing labels)
+2. **Mutation** — auto-add default values (labels, security context defaults)
+3. **Generation** — auto-create companion resources (default NetworkPolicy per namespace)
+
+## Policy Testing (required before deploy)
+
+```bash
+# OPA/Gatekeeper: unit test policies
+opa test policies/ -v
+
+# Kyverno: test policies against example manifests
+kyverno test . --test-case-selector "policy=disallow-privileged"
+```
+
+## Mandatory Policies (deploy to all clusters)
+
+- `disallow-privileged-containers`
+- `require-non-root-user`
+- `require-resource-limits`
+- `require-readonly-root-filesystem` (warn in staging, enforce in production)
+- `require-image-digest` (no `:latest` tags)
+- `disallow-host-namespaces` (no hostNetwork, hostPID, hostIPC)

package/areas/devops/devsecops/rules/shift-left-policy.md

@@ -0,0 +1,26 @@
+# Rule: Shift-Left Security Policy
+
+**Priority**: P0 — Security checks are part of CI, not a post-deployment audit.
+
+## Security Pipeline Gates (mandatory, in order)
+
+1. **Pre-commit**: `trufflehog` / `git-secrets` — detect secrets before they enter repo
+2. **CI lint stage**: `semgrep` (SAST) — detect code-level vulnerabilities
+3. **CI build stage**: `trivy fs .` — scan dependencies before building image
+4. **CI after build**: `trivy image` — scan built image for OS + package CVEs
+5. **CI after build**: SBOM generated (Syft) + attached to image (cosign)
+6. **CD pre-deploy**: image signature verified (cosign verify) — unsigned = blocked
+
+## Severity Thresholds
+
+| Severity | In PR/CI | In CD (deploy) |
+|:---|:---|:---|
+| Critical | Block merge | Block deploy |
+| High | Block merge | Block deploy |
+| Medium | Warning comment | Warning; deploy allowed |
+| Low | Informational | Pass |
+
+## Exception Process
+
+- Critical/High with no available fix: documented exception + Jira ticket + 30-day expiry.
+- CVE in base image, fix not yet available: pin exception with digest; revisit weekly.

package/areas/devops/devsecops/skills/container-hardening/SKILL.md

@@ -0,0 +1,146 @@
+---
+name: container-hardening
+type: skill
+description: Harden container images and Kubernetes workload security contexts — distroless, multi-stage, minimal attack surface.
+related-rules:
+  - container-security.md
+  - shift-left-policy.md
+allowed-tools: Read, Write, Edit, Bash
+---
+
+# Skill: Container Hardening
+
+> **Expertise:** Minimal images, distroless, multi-stage builds, security context, Dockerfile best practices, Trivy scanning.
+
+## When to load
+
+When building a new Dockerfile, hardening an existing image, failing Trivy scan, or setting up pod security contexts.
+
+## Hardened Dockerfile (Python example)
+
+```dockerfile
+# ── Stage 1: Build (has build tools, not in final image) ──
+FROM python:3.12-slim@sha256:<pinned-digest> AS builder
+
+WORKDIR /app
+COPY requirements.txt .
+RUN pip install --user --no-cache-dir -r requirements.txt
+
+# ── Stage 2: Runtime (minimal, no build tools) ───────────
+FROM python:3.12-slim@sha256:<pinned-digest>
+
+# Create non-root user
+RUN groupadd -r appgroup --gid=1000 && \
+    useradd -r -g appgroup --uid=1000 --no-create-home appuser
+
+WORKDIR /app
+
+# Copy only built artifacts from builder
+COPY --from=builder /root/.local /home/appuser/.local
+COPY --chown=appuser:appgroup src/ ./src/
+
+# Remove SETUID binaries (attack surface reduction)
+RUN find / -perm /6000 -type f -exec chmod a-s {} \; 2>/dev/null || true
+
+# Switch to non-root
+USER 1000:1000
+
+# Read-only filesystem friendly: temp dir for app writes
+VOLUME ["/tmp"]
+
+EXPOSE 8080
+
+# Prefer exec form (handles signals correctly)
+ENTRYPOINT ["python", "-m", "uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8080"]
+```
+
+## Distroless (Go example — smallest attack surface)
+
+```dockerfile
+FROM golang:1.23-alpine AS builder
+WORKDIR /app
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o server ./cmd/server
+
+# Distroless: no shell, no package manager, no OS utilities
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=builder /app/server /server
+USER nonroot:nonroot
+EXPOSE 8080
+ENTRYPOINT ["/server"]
+```
+
+## Pod Security Context (K8s manifest)
+
+```yaml
+spec:
+  securityContext:
+    # Pod-level
+    runAsNonRoot: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    fsGroup: 1000
+    seccompProfile:
+      type: RuntimeDefault    # enables syscall filtering
+
+  containers:
+    - name: app
+      securityContext:
+        # Container-level
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        capabilities:
+          drop: ["ALL"]
+          # add only if explicitly needed:
+          # add: ["NET_BIND_SERVICE"]  # bind to port < 1024
+
+      # Writable temp dir for app that needs /tmp
+      volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+
+  volumes:
+    - name: tmp
+      emptyDir: {}
+```
+
+## Trivy Scan Workflow
+
+```bash
+# Scan filesystem (during build, before image creation)
+trivy fs . \
+  --severity CRITICAL,HIGH \
+  --exit-code 1 \
+  --ignorefile .trivyignore
+
+# Scan built image
+trivy image \
+  --severity CRITICAL,HIGH \
+  --exit-code 1 \
+  --format sarif \
+  --output trivy-results.sarif \
+  registry.example.com/my-service:${GIT_SHA}
+
+# Scan with SBOM (generates and scans simultaneously)
+trivy image \
+  --format cyclonedx \
+  --output sbom.json \
+  registry.example.com/my-service:${GIT_SHA}
+```
+
+## .trivyignore (CVE exceptions)
+
+```
+# CVE-2024-XXXXX - no fix available; tracked in JIRA SEC-456; review 2024-12-01
+CVE-2024-XXXXX
+```
+
+## Common Hardening Failures + Fixes
+
+| Failure | Cause | Fix |
+|:---|:---|:---|
+| `runAsRoot` | No USER in Dockerfile | Add `USER 1000:1000` |
+| Mutable tag | `:latest` or `:main` | Pin to `@sha256:digest` |
+| SETUID binary | Default OS image | Strip: `chmod a-s /usr/bin/passwd` |
+| Writable root FS | `readOnlyRootFilesystem: true` blocks writes | Mount `emptyDir` for `/tmp`, `/var/run` |
+| Secrets in image | `COPY .env` or `ARG password` | Multi-stage + Docker secrets |

package/areas/devops/devsecops/skills/opa-policies/SKILL.md

@@ -0,0 +1,188 @@
+---
+name: opa-policies
+type: skill
+description: Write OPA/Gatekeeper and Kyverno admission policies for Kubernetes security guardrails.
+related-rules:
+  - policy-as-code.md
+  - container-security.md
+allowed-tools: Read, Write, Edit, Bash
+---
+
+# Skill: OPA Policies & Kyverno
+
+> **Expertise:** Gatekeeper ConstraintTemplates, Kyverno ClusterPolicies, validation + mutation + generation.
+
+## When to load
+
+When writing admission policies, testing policy changes, or debugging policy-blocked deployments.
+
+## Gatekeeper: ConstraintTemplate + Constraint
+
+```yaml
+# 1. ConstraintTemplate — defines the policy logic in Rego
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: k8srequirenonroot
+spec:
+  crd:
+    spec:
+      names: { kind: K8sRequireNonRoot }
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package k8srequirenonroot
+
+        violation[{"msg": msg}] {
+          container := input.review.object.spec.containers[_]
+          not container.securityContext.runAsNonRoot
+          msg := sprintf("Container '%v' must set runAsNonRoot: true", [container.name])
+        }
+
+        violation[{"msg": msg}] {
+          container := input.review.object.spec.containers[_]
+          container.securityContext.runAsUser == 0
+          msg := sprintf("Container '%v' must not run as UID 0", [container.name])
+        }
+
+---
+# 2. Constraint — applies the template to specific resources/namespaces
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sRequireNonRoot
+metadata:
+  name: require-non-root-production
+spec:
+  enforcementAction: deny           # deny | warn | dryrun
+  match:
+    kinds:
+      - apiGroups: [apps]
+        kinds: [Deployment, StatefulSet, DaemonSet]
+    namespaceSelector:
+      matchExpressions:
+        - key: environment
+          operator: In
+          values: [production, staging]
+```
+
+## Gatekeeper: Require Image Digest
+
+```yaml
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: k8srequireimagedigest
+spec:
+  crd:
+    spec:
+      names: { kind: K8sRequireImageDigest }
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package k8srequireimagedigest
+
+        violation[{"msg": msg}] {
+          container := input.review.object.spec.containers[_]
+          not contains(container.image, "@sha256:")
+          msg := sprintf(
+            "Container '%v' image '%v' must reference a digest (@sha256:...), not a mutable tag",
+            [container.name, container.image]
+          )
+        }
+```
+
+## Kyverno: Simpler YAML Policies
+
+```yaml
+# Disallow privileged containers (Kyverno)
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: disallow-privileged-containers
+spec:
+  validationFailureAction: Enforce
+  rules:
+    - name: check-privileged
+      match:
+        any:
+          - resources:
+              kinds: [Pod]
+              namespaces: [production, staging]
+      validate:
+        message: "Privileged containers are not allowed in production/staging"
+        pattern:
+          spec:
+            containers:
+              - =(securityContext):
+                  =(privileged): "false"
+```
+
+```yaml
+# Kyverno MUTATION — auto-add security context defaults
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: add-default-securitycontext
+spec:
+  rules:
+    - name: add-security-context
+      match:
+        any:
+          - resources: { kinds: [Pod] }
+      mutate:
+        patchStrategicMerge:
+          spec:
+            containers:
+              - (name): "*"
+                securityContext:
+                  +(runAsNonRoot): true
+                  +(allowPrivilegeEscalation): false
+                  +(readOnlyRootFilesystem): true
+```
+
+## Policy Testing
+
+```bash
+# OPA unit tests
+cat > policies/test_nonroot.rego << 'REGO'
+package k8srequirenonroot
+
+test_deny_root_container {
+  violation[{"msg": _}] with input as {
+    "review": {"object": {"spec": {"containers": [
+      {"name": "app", "securityContext": {"runAsUser": 0}}
+    ]}}}
+  }
+}
+
+test_allow_nonroot_container {
+  count(violation) == 0 with input as {
+    "review": {"object": {"spec": {"containers": [
+      {"name": "app", "securityContext": {"runAsNonRoot": true, "runAsUser": 1000}}
+    ]}}}
+  }
+}
+REGO
+
+opa test policies/ -v
+
+# Kyverno test with example manifests
+kyverno test . \
+  --test-case-selector "policy=disallow-privileged-containers"
+
+# Check which policies blocked a recent admission
+kubectl get events -n <ns> | grep "denied\|violated"
+```
+
+## Debugging Policy Denials
+
+```bash
+# See why a deployment was rejected
+kubectl describe deploy <n> -n <ns>
+# Look at Events section for: "admission webhook ... denied"
+
+# Check active constraints
+kubectl get constraints
+
+# Check constraint violations (audit mode)
+kubectl get k8srequirenonroot.constraints.gatekeeper.sh -o jsonpath='{.items[*].status.violations}'
+```