@nockdev/awf 6.2.0

package/.agent/skills/cross-cutting/bun/data/tooling.yaml

@@ -0,0 +1,192 @@
+# =============================================================================
+# Bun 1.3+ Development Tools Patterns (Feb 2026)
+# =============================================================================
+# Testing, bundling, CLI tools
+
+metadata:
+  skill: bun
+  domain: tooling
+  version: "1.3.3"
+  updated: "2026-02-05"
+  patterns_count: 9
+
+patterns:
+  - id: bun020
+    name: bun test
+    category: testing
+    version: "1.0+"
+    description: Jest-compatible test runner with built-in coverage and watch mode
+    text: test runner describe expect mock unit integration jest vitest
+    example: |
+      // test/example.test.ts
+      import { describe, expect, it, mock } from "bun:test";
+
+      describe("Calculator", () => {
+        it("should add numbers", () => {
+          expect(1 + 2).toBe(3);
+        });
+      });
+
+      // Run: bun test --watch --coverage
+    severity: HIGH
+    docs_url: https://bun.sh/docs/cli/test
+
+  - id: bun021
+    name: Bun.build
+    category: bundler
+    version: "1.0+"
+    description: ESBuild-inspired bundler for browser and server, TypeScript, JSX, CSS
+    text: bundle bundler minify sourcemap browser node production build
+    example: |
+      await Bun.build({
+        entrypoints: ["./src/index.tsx"],
+        outdir: "./dist",
+        target: "browser",
+        minify: true,
+        splitting: true,
+        sourcemap: "external",
+      });
+    severity: HIGH
+    docs_url: https://bun.sh/docs/bundler
+
+  - id: bun022
+    name: HTML Imports
+    category: frontend
+    version: "1.2+"
+    description: Zero-config frontend dev - auto minify and bundle JS/CSS from HTML
+    text: html import zero config frontend react transpile bundle hmr
+    example: |
+      <!-- index.html -->
+      <script type="module" src="./app.tsx"></script>
+
+      # Run: bun ./index.html
+      # Auto-transpiles TypeScript, bundles, HMR enabled
+    severity: HIGH
+    docs_url: https://bun.sh/docs/runtime/loaders
+
+  - id: bun023
+    name: bun update
+    category: cli
+    version: "1.2+"
+    description: Interactive dependency update with semver awareness
+    text: update dependencies package upgrade interactive npm
+    example: |
+      # Interactive update
+      bun update --interactive
+
+      # Update specific package
+      bun update react
+
+      # Update all to latest
+      bun update --latest
+    severity: MEDIUM
+    docs_url: https://bun.sh/docs/cli/update
+
+  - id: bun024
+    name: bun compile
+    category: cli
+    version: "1.3+"
+    description: Cross-platform compile to standalone executable
+    text: compile standalone executable binary cross platform deploy
+    example: |
+      # Compile for Linux
+      bun compile --target=linux-x64 ./server.ts
+
+      # Compile for Windows
+      bun compile --target=windows-x64 ./server.ts
+
+      # Compile for macOS ARM
+      bun compile --target=darwin-arm64 ./server.ts
+    severity: HIGH
+    docs_url: https://bun.sh/docs/bundler/executables
+
+  - id: bun025
+    name: Security Scanner
+    category: security
+    version: "1.3+"
+    description: Scan packages for vulnerabilities during install (Socket.dev integration)
+    text: security scanner vulnerability scan audit socket dependencies
+    example: |
+      # Scan during install
+      bun install --security-scan
+
+      # Audit existing packages
+      bun audit
+    severity: CRITICAL
+    docs_url: https://bun.sh/docs/cli/security
+
+  # ✅ NEW: Bun 1.3.x Features (Feb 2026)
+  - id: bun026
+    name: Bun.SQL Unified Client
+    category: database
+    version: "1.3+"
+    description: |
+      Unified database API for MySQL, MariaDB, PostgreSQL, SQLite.
+      Native implementation, zero external dependencies, high performance.
+    text: sql database mysql postgres postgresql sqlite mariadb query unified native
+    example: |
+      import { SQL } from "bun";
+
+      // ✅ Unified API across databases
+      const db = SQL.connect("postgres://localhost/mydb");
+      // or: SQL.connect("mysql://localhost/mydb")
+      // or: SQL.connect("sqlite://./local.db")
+
+      const users = await db.query("SELECT * FROM users WHERE id = ?", [1]);
+
+      // Transaction support
+      await db.transaction(async (tx) => {
+        await tx.query("INSERT INTO orders ...");
+        await tx.query("UPDATE inventory ...");
+      });
+    severity: HIGH
+    docs_url: https://bun.sh/docs/api/sql
+
+  - id: bun027
+    name: Built-in Redis Client
+    category: database
+    version: "1.3+"
+    description: |
+      Native Redis client, 7.9x faster than ioredis.
+      Zero dependencies, supports cluster, streams, Lua scripting (planned).
+    text: redis cache client native fast ioredis cluster streams pubsub
+    example: |
+      import { Redis } from "bun";
+
+      // ✅ 7.9x faster than ioredis
+      const redis = Redis.connect("redis://localhost:6379");
+
+      // Basic operations
+      await redis.set("key", "value");
+      const value = await redis.get("key");
+
+      // Pub/Sub
+      await redis.subscribe("channel", (message) => {
+        console.log("Received:", message);
+      });
+
+      await redis.publish("channel", "Hello!");
+    severity: HIGH
+    docs_url: https://bun.sh/docs/api/redis
+
+  - id: bun028
+    name: CompressionStream API
+    category: runtime
+    version: "1.3+"
+    description: Web standard CompressionStream/DecompressionStream for gzip, deflate
+    text: compression stream gzip deflate browser standard web api
+    example: |
+      // ✅ Web standard compression
+      const input = new Blob(["Hello, World!".repeat(1000)]);
+
+      // Compress
+      const compressed = await new Response(
+        input.stream().pipeThrough(new CompressionStream("gzip"))
+      ).blob();
+
+      // Decompress
+      const decompressed = await new Response(
+        compressed.stream().pipeThrough(new DecompressionStream("gzip"))
+      ).text();
+    severity: MEDIUM
+    docs_url: https://bun.sh/docs/api/compression

package/.agent/skills/cross-cutting/ci-cd/META.yaml

@@ -0,0 +1,60 @@
+name: ci-cd
+version: "6.2.0"
+category: infrastructure
+tier: 3
+
+desc: "CI/CD pipeline patterns for GitHub Actions, GitLab CI, and GitOps. Includes SLSA Build Level 3, ARM64 runners, security scanning."
+
+patterns:
+  total: 20
+  domains:
+    github-actions: 6
+    gitlab-ci: 5
+    security: 5
+    deployment: 4
+
+hsa:
+  enabled: true
+  adapter: cicd_adapter.py
+
+triggers:
+  file_patterns:
+    - ".github/workflows/*.yml"
+    - ".gitlab-ci.yml"
+    - "Jenkinsfile"
+    - "azure-pipelines.yml"
+    - ".circleci/config.yml"
+  keywords:
+    # General
+    - ci cd
+    - pipeline
+    - continuous integration
+    - continuous deployment
+    - workflow
+    # GitHub Actions
+    - github actions
+    - actions workflow
+    - reusable workflow
+    - composite action
+    - arm64 runner
+    - slsa attestation
+    # Security
+    - dependency review
+    - code scanning
+    - secret scanning
+    - artifact attestation
+    - supply chain
+  intents:
+    - create pipeline
+    - setup ci
+    - deploy workflow
+    - secure pipeline
+
+related_skills:
+  - docker
+  - kubernetes
+  - aws
+  - security
+
+prevent_confusion_with:
+  - aws: "ci-cd is platform-agnostic, aws covers AWS-specific deployment"

package/.agent/skills/cross-cutting/ci-cd/data/github_actions.yaml

@@ -0,0 +1,248 @@
+# =============================================================================
+# GitHub Actions Patterns (Feb 2026)
+# =============================================================================
+# ARM64 runners, SLSA, artifact attestations from 2025-2026
+
+metadata:
+  skill: ci-cd
+  domain: github-actions
+  version: "2026.1"
+  updated: "2026-02-05"
+  patterns_count: 6
+
+patterns:
+  - id: cicd001
+    name: ARM64 Linux Runners
+    category: github-actions
+    version: "2024+"
+    description: Native ARM64/Graviton runners for 40% cost savings
+    text: github actions arm64 graviton linux runner cost savings
+    example: |
+      # GitHub Actions ARM64 runner
+      jobs:
+        build:
+          runs-on: ubuntu-24.04-arm64  # ARM64 runner
+          steps:
+            - uses: actions/checkout@v4
+            - name: Build
+              run: go build -v ./...
+
+      # Cost comparison:
+      # - ubuntu-latest (x64): $0.008/min
+      # - ubuntu-24.04-arm64: $0.005/min (37% savings!)
+
+      # Performance for Go/Rust/Node:
+      # - Often 10-20% faster builds
+      # - Better for container builds
+
+      # Matrix for multi-arch:
+      strategy:
+        matrix:
+          runner: [ubuntu-latest, ubuntu-24.04-arm64]
+    severity: HIGH
+    docs_url: https://docs.github.com/en/actions/using-github-hosted-runners
+
+  - id: cicd002
+    name: SLSA Build Level 3
+    category: security
+    version: "2024+"
+    description: Supply chain attestation with SLSA Level 3 provenance
+    text: slsa attestation supply chain security provenance level 3
+    example: |
+      name: SLSA Build
+
+      on:
+        push:
+          tags: ['v*']
+
+      jobs:
+        build:
+          runs-on: ubuntu-latest
+          permissions:
+            id-token: write
+            contents: read
+            attestations: write
+          steps:
+            - uses: actions/checkout@v4
+
+            - name: Build artifact
+              run: go build -o myapp
+
+            - name: Generate SLSA provenance
+              uses: actions/attest-build-provenance@v2
+              with:
+                subject-path: 'myapp'
+                # SLSA Level 3 - Hermetic, Parameterless
+                slsa-level: 3
+
+      # SLSA Levels:
+      # - Level 1: Basic attestation
+      # - Level 2: Build service generates provenance
+      # - Level 3: Hermetic builds, non-falsifiable provenance
+    severity: CRITICAL
+    docs_url: https://slsa.dev/spec/v1.0/
+
+  - id: cicd003
+    name: Artifact Attestations
+    category: security
+    version: "2024+"
+    description: Cryptographic proof of artifact origin
+    text: artifact attestation sigstore cosign container signing
+    example: |
+      name: Container Build with Attestation
+
+      jobs:
+        build:
+          runs-on: ubuntu-latest
+          permissions:
+            packages: write
+            id-token: write
+            attestations: write
+          steps:
+            - uses: docker/login-action@v3
+              with:
+                registry: ghcr.io
+                username: ${{ github.actor }}
+                password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Build and push
+              id: push
+              uses: docker/build-push-action@v5
+              with:
+                push: true
+                tags: ghcr.io/${{ github.repository }}:latest
+
+            - name: Attest container
+              uses: actions/attest-build-provenance@v2
+              with:
+                subject-name: ghcr.io/${{ github.repository }}
+                subject-digest: ${{ steps.push.outputs.digest }}
+
+      # Verify attestation:
+      # gh attestation verify ghcr.io/org/repo:latest
+    severity: HIGH
+    docs_url: https://docs.github.com/en/actions/security-guides/using-artifact-attestations
+
+  - id: cicd004
+    name: Environment Deployment Protection
+    category: deployment
+    version: "2024+"
+    description: Required reviewers and wait timers for production deployments
+    text: github actions environment protection deployment approval
+    example: |
+      name: Deploy to Production
+
+      on:
+        push:
+          branches: [main]
+
+      jobs:
+        deploy-staging:
+          runs-on: ubuntu-latest
+          environment: staging
+          steps:
+            - run: ./deploy.sh staging
+
+        deploy-production:
+          needs: deploy-staging
+          runs-on: ubuntu-latest
+          # Protection rules in repo settings
+          environment:
+            name: production
+            url: https://example.com
+          steps:
+            - run: ./deploy.sh production
+
+      # Environment protection rules (configured in UI):
+      # - Required reviewers: team-leads
+      # - Wait timer: 15 minutes
+      # - Branch restrictions: main only
+      # - Deployment branches: tags matching v*
+    severity: HIGH
+    docs_url: https://docs.github.com/en/actions/deployment/targeting-different-environments
+
+  - id: cicd005
+    name: Reusable Workflows
+    category: github-actions
+    version: "2022+"
+    description: DRY workflows with inputs and secrets passthrough
+    text: reusable workflows dry composite shared workflow call
+    example: |
+      # .github/workflows/reusable-build.yml
+      name: Reusable Build
+
+      on:
+        workflow_call:
+          inputs:
+            node-version:
+              required: true
+              type: string
+          secrets:
+            npm-token:
+              required: true
+
+      jobs:
+        build:
+          runs-on: ubuntu-latest
+          steps:
+            - uses: actions/checkout@v4
+            - uses: actions/setup-node@v4
+              with:
+                node-version: ${{ inputs.node-version }}
+            - run: npm ci
+              env:
+                NPM_TOKEN: ${{ secrets.npm-token }}
+
+      # Caller workflow
+      # .github/workflows/main.yml
+      jobs:
+        call-build:
+          uses: ./.github/workflows/reusable-build.yml
+          with:
+            node-version: '20'
+          secrets:
+            npm-token: ${{ secrets.NPM_TOKEN }}
+    severity: MEDIUM
+    docs_url: https://docs.github.com/en/actions/using-workflows/reusing-workflows
+
+  - id: cicd006
+    name: Composite Actions
+    category: github-actions
+    version: "2022+"
+    description: Bundle multiple steps into reusable custom action
+    text: composite action custom reusable steps bundle action.yml
+    example: |
+      # action.yml - Custom composite action
+      name: 'Build and Test'
+      description: 'Build and test Node.js project'
+      inputs:
+        node-version:
+          description: 'Node.js version'
+          required: false
+          default: '20'
+      runs:
+        using: 'composite'
+        steps:
+          - uses: actions/setup-node@v4
+            with:
+              node-version: ${{ inputs.node-version }}
+              cache: 'npm'
+
+          - name: Install
+            shell: bash
+            run: npm ci
+
+          - name: Lint
+            shell: bash
+            run: npm run lint
+
+          - name: Test
+            shell: bash
+            run: npm test -- --coverage
+
+      # Use in workflow:
+      - uses: ./.github/actions/build-and-test
+        with:
+          node-version: '22'
+    severity: MEDIUM
+    docs_url: https://docs.github.com/en/actions/creating-actions/creating-a-composite-action

package/.agent/skills/cross-cutting/ci-cd/data/security.yaml

@@ -0,0 +1,211 @@
+# =============================================================================
+# CI/CD Security Patterns (Feb 2026)
+# =============================================================================
+# Dependency review, secret scanning, supply chain security
+
+metadata:
+  skill: ci-cd
+  domain: security
+  version: "2026.1"
+  updated: "2026-02-05"
+  patterns_count: 5
+
+patterns:
+  - id: cicd010
+    name: Dependency Review Action
+    category: security
+    version: "2023+"
+    description: Block PRs that introduce vulnerable dependencies
+    text: dependency review vulnerability scan pr check security
+    example: |
+      name: Dependency Review
+
+      on: pull_request
+
+      permissions:
+        contents: read
+        pull-requests: write
+
+      jobs:
+        dependency-review:
+          runs-on: ubuntu-latest
+          steps:
+            - uses: actions/checkout@v4
+            - uses: actions/dependency-review-action@v4
+              with:
+                # Fail on critical/high vulnerabilities
+                fail-on-severity: high
+                # Allow specific licenses
+                allow-licenses: MIT, Apache-2.0, BSD-3-Clause
+                # Deny copyleft for commercial projects
+                deny-licenses: GPL-3.0, AGPL-3.0
+
+      # Also enable in repo settings:
+      # - Dependabot security updates
+      # - Dependabot version updates
+    severity: CRITICAL
+    docs_url: https://github.com/actions/dependency-review-action
+
+  - id: cicd011
+    name: CodeQL Security Scanning
+    category: security
+    version: "2022+"
+    description: Semantic code analysis for security vulnerabilities
+    text: codeql security scanning sast static analysis vulnerabilities
+    example: |
+      name: CodeQL Analysis
+
+      on:
+        push:
+          branches: [main]
+        pull_request:
+          branches: [main]
+        schedule:
+          - cron: '0 6 * * 1'  # Weekly
+
+      jobs:
+        analyze:
+          runs-on: ubuntu-latest
+          permissions:
+            security-events: write
+            contents: read
+          strategy:
+            matrix:
+              language: ['javascript', 'python', 'go']
+          steps:
+            - uses: actions/checkout@v4
+
+            - uses: github/codeql-action/init@v3
+              with:
+                languages: ${{ matrix.language }}
+                # Use extended queries for more findings
+                queries: +security-extended
+
+            - uses: github/codeql-action/autobuild@v3
+
+            - uses: github/codeql-action/analyze@v3
+              with:
+                category: "/language:${{ matrix.language }}"
+
+      # Results appear in Security tab
+    severity: CRITICAL
+    docs_url: https://docs.github.com/en/code-security/code-scanning
+
+  - id: cicd012
+    name: Secret Scanning Push Protection
+    category: security
+    version: "2023+"
+    description: Block pushes containing hardcoded secrets
+    text: secret scanning push protection block credentials tokens
+    example: |
+      # Enable in repo settings:
+      # Settings > Security > Secret scanning > Push protection
+
+      # When enabled:
+      # 1. Git push blocked if secrets detected
+      # 2. Developer sees which secrets found
+      # 3. Options: remove secret, bypass (with reason), cancel
+
+      # Supported secret types (200+):
+      # - AWS keys
+      # - GitHub tokens
+      # - Azure credentials
+      # - Database passwords
+      # - API keys
+
+      # Custom patterns (org level):
+      # Pattern: mycompany_[a-zA-Z0-9]{32}
+      # Used for internal API keys
+
+      # API to check commits:
+      gh api /repos/{owner}/{repo}/secret-scanning/alerts
+
+      # Best practice: Use GHAS for enterprise
+    severity: CRITICAL
+    docs_url: https://docs.github.com/en/code-security/secret-scanning
+
+  - id: cicd013
+    name: OIDC for Cloud Authentication
+    category: security
+    version: "2022+"
+    description: Keyless auth to AWS/Azure/GCP using GitHub OIDC
+    text: oidc authentication keyless aws azure gcp workload identity
+    example: |
+      name: Deploy with OIDC
+
+      on:
+        push:
+          branches: [main]
+
+      permissions:
+        id-token: write  # Required for OIDC
+        contents: read
+
+      jobs:
+        deploy:
+          runs-on: ubuntu-latest
+          steps:
+            # AWS
+            - uses: aws-actions/configure-aws-credentials@v4
+              with:
+                role-to-assume: arn:aws:iam::123456789:role/GitHubActions
+                aws-region: us-east-1
+
+            # Azure
+            - uses: azure/login@v2
+              with:
+                client-id: ${{ secrets.AZURE_CLIENT_ID }}
+                tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+                subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+            # GCP
+            - uses: google-github-actions/auth@v2
+              with:
+                workload_identity_provider: 'projects/123/locations/global/workloadIdentityPools/...'
+                service_account: 'github-actions@project.iam.gserviceaccount.com'
+
+      # Benefits: No long-lived credentials, automatic rotation
+    severity: CRITICAL
+    docs_url: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect
+
+  - id: cicd014
+    name: Permissions Hardening
+    category: security
+    version: "2022+"
+    description: Principle of least privilege for workflow permissions
+    text: permissions security hardening principle least privilege token
+    example: |
+      name: Secure Workflow
+
+      on: push
+
+      # Restrictive default permissions
+      permissions:
+        contents: read
+
+      jobs:
+        build:
+          runs-on: ubuntu-latest
+          steps:
+            - uses: actions/checkout@v4
+            - run: npm ci && npm test
+
+        publish:
+          needs: build
+          runs-on: ubuntu-latest
+          # Grant write only where needed
+          permissions:
+            contents: read
+            packages: write
+          steps:
+            - uses: actions/checkout@v4
+            - run: npm publish
+
+      # Security best practices:
+      # 1. Default to read-only at workflow level
+      # 2. Grant write permissions per-job
+      # 3. Never use permissions: write-all
+      # 4. Audit third-party actions
+      # 5. Pin action versions to SHA
+    severity: HIGH
+    docs_url: https://docs.github.com/en/actions/security-guides/automatic-token-authentication