@opengroundplan/core 0.1.1

package/catalog/sources/devops-cicd.yaml

@@ -0,0 +1,422 @@
+# Groundplan template source catalog — category: devops-cicd
+#
+# Research date: 2026-07-18
+#
+# PROVENANCE / VERIFICATION NOTES
+# --------------------------------
+# License classes were verified from PRIMARY SOURCES: the actual LICENSE file text fetched
+# from raw.githubusercontent.com for every repo below, not from memory. The `spdx` field is
+# the SPDX id implied by that license text.
+#
+# CAVEAT ON THE GITHUB REST API: the unauthenticated /repos/{owner}/{repo} budget (60 req/hr,
+# per-IP) was fully drained for this entire research window by concurrent sibling workflows
+# sharing the same IP. `stars` therefore comes from the server-rendered star counter on the
+# github.com repo page, `lastCommit` from each repo's commits atom feed
+# (github.com/{repo}/commits/{branch}.atom), and `archived` from the repo page's archived
+# banner. All three are primary GitHub sources, but they are NOT the REST API, and
+# `license.spdx_id` was not read back from the API. A follow-up pass should reconcile these
+# against /repos/{owner}/{repo} when API budget is available.
+#
+# Two license findings that contradict common assumptions — both caught by reading the text:
+#   * the-nix-way/dev-templates is MPL-2.0 (NOT MIT) -> reference-only, do not copy files.
+#   * opentofu/opentofu is MPL-2.0 -> reference-only.
+# A naive text matcher flags both as AGPL, because the MPL-2.0 "Secondary License" clause
+# literally names the GNU Affero GPL. Order MPL detection BEFORE GNU detection.
+#
+# All 15 sources below are actively maintained (every last commit in 2026) and none archived.
+
+category: devops-cicd
+
+sources:
+  - name: devcontainers/templates
+    url: https://github.com/devcontainers/templates
+    stars: 1420
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-08"
+    complexity: simple
+    stack: devcontainer, docker, json
+    whatToBorrow: >-
+      The canonical devcontainer-template shape. src/typescript-node/.devcontainer/devcontainer.json
+      and src/python/.devcontainer/devcontainer.json are minimal, strip-down-ready bases.
+      src/go/devcontainer-template.json shows the template-manifest format (id, name, options
+      with type/proposals/default) — this is almost exactly Groundplan's own layer-option model and
+      is worth mirroring for how user-facing options get declared and substituted.
+    whatToAvoid: >-
+      Templates are intentionally thin — they delegate nearly everything to Features, so a
+      template alone gives you an empty box. The ${templateOption:x} substitution syntax is
+      devcontainer-CLI specific; do not leak it into Groundplan's own templating.
+    proposedLayerIds:
+      - devcontainer-base
+      - devcontainer-node
+      - devcontainer-python
+      - devcontainer-go
+
+  - name: devcontainers/features
+    url: https://github.com/devcontainers/features
+    stars: 1503
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-14"
+    complexity: standard
+    stack: devcontainer, bash, oci
+    whatToBorrow: >-
+      The best real-world model of a composable layer system. src/docker-in-docker/devcontainer-feature.json
+      declares options + installsAfter ordering; src/node/install.sh is a disciplined idempotent
+      installer (detects distro, pins versions, cleans package caches). Borrow the
+      feature.json + install.sh pairing and the installsAfter dependency-ordering concept
+      directly for Groundplan layer composition.
+    whatToAvoid: >-
+      install.sh scripts carry heavy multi-distro branching (apt/apk/yum) that is mostly dead
+      weight if you target one base image. Features are distributed as OCI artifacts — do not
+      inherit that packaging assumption.
+    proposedLayerIds:
+      - devcontainer-features
+      - devcontainer-docker-in-docker
+      - devcontainer-base
+
+  - name: docker/awesome-compose
+    url: https://github.com/docker/awesome-compose
+    stars: 45865
+    spdx: CC0-1.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-06-15"
+    complexity: simple
+    stack: docker-compose, multi-language
+    whatToBorrow: >-
+      A large bank of working, minimal compose stacks to adapt per language layer.
+      react-express-mysql/compose.yaml and nginx-golang-postgres/compose.yaml are clean
+      references for service wiring, depends_on with healthchecks, and named-volume
+      persistence. CC0-1.0 means zero attribution burden — the most freely copyable source
+      in this category.
+    whatToAvoid: >-
+      These are demos, not production: no resource limits, no restart policies, secrets and
+      DB passwords inline as plaintext env, and several stacks pin old image tags. Never ship
+      a compose file from here without replacing credentials with secrets and adding
+      healthcheck/restart policy.
+    proposedLayerIds:
+      - compose-local-dev
+      - compose-postgres
+      - compose-mysql
+      - compose-nginx-proxy
+
+  - name: nickjj/docker-rails-example
+    url: https://github.com/nickjj/docker-rails-example
+    stars: 1077
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-08"
+    complexity: simple
+    stack: docker, rails, github-actions
+    whatToBorrow: >-
+      The single best small-repo example of a production-shaped container setup. The Dockerfile
+      is a genuine multi-stage build with a non-root user and cached dependency layers;
+      compose.yaml uses profiles and healthchecks; the `run` script is an excellent
+      task-runner pattern (a plain shell file of named functions) that replaces a Makefile
+      and works identically on host and in-container. .github/workflows/ci.yml is a compact
+      lint + test + build pipeline.
+    whatToAvoid: >-
+      Rails-specific throughout (Bundler, Sidekiq, asset precompile) — borrow the Dockerfile
+      staging and `run` script structure, not the app wiring. Single-author repo, so bus
+      factor is one.
+    proposedLayerIds:
+      - container-docker-multistage
+      - container-nonroot-user
+      - task-runner-shell
+      - ci-github-actions
+
+  - name: actions/starter-workflows
+    url: https://github.com/actions/starter-workflows
+    stars: 11850
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-06-01"
+    complexity: standard
+    stack: github-actions, yaml
+    whatToBorrow: >-
+      GitHub's own baseline workflows — the safest default CI layer to generate from.
+      ci/node.js.yml (matrix strategy over node-version + cache), ci/python-app.yml, ci/go.yml,
+      ci/docker-image.yml and ci/docker-publish.yml (buildx + registry login + metadata-action
+      tagging), code-scanning/codeql.yml, and deployments/aws.yml. Verified present at those
+      paths.
+    whatToAvoid: >-
+      There is NO ci/terraform.yml here despite being widely assumed — do not reference it.
+      Workflows are deliberately generic: no concurrency groups, no least-privilege
+      `permissions:` blocks, and most pin actions by mutable major tag (@v4) rather than
+      commit SHA. Add permissions and SHA-pinning before shipping.
+    proposedLayerIds:
+      - ci-github-actions
+      - ci-matrix-node
+      - ci-matrix-python
+      - ci-docker-publish
+      - security-codeql
+
+  - name: stefanprodan/podinfo
+    url: https://github.com/stefanprodan/podinfo
+    stars: 5951
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-13"
+    complexity: standard
+    stack: kubernetes, helm, kustomize, go
+    whatToBorrow: >-
+      The reference app for Kubernetes delivery patterns, and unusually complete for its size.
+      charts/podinfo/ is a well-formed Helm chart (values.yaml is a good schema model,
+      templates/hpa.yaml a clean autoscaler); kustomize/deployment.yaml gives the parallel
+      Kustomize path for the same workload; .github/workflows/release.yml shows tag-driven
+      multi-arch image publish; the Makefile is a tidy build/test/release target set.
+    whatToAvoid: >-
+      It is a demo microservice — the Go application code is not a starting point for real
+      services. Requires Apache-2.0 NOTICE/attribution when you copy chart files.
+    proposedLayerIds:
+      - helm-chart-app
+      - k8s-manifests-kustomize
+      - k8s-hpa-autoscaling
+      - ci-release-multiarch
+
+  - name: terraform-aws-modules/terraform-aws-vpc
+    url: https://github.com/terraform-aws-modules/terraform-aws-vpc
+    stars: 3249
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-04-02"
+    complexity: standard
+    stack: terraform, aws
+    whatToBorrow: >-
+      The de-facto model for how a Terraform module should be laid out: main.tf / variables.tf /
+      outputs.tf / versions.tf separation with required_providers version constraints pinned in
+      versions.tf. examples/complete/main.tf is the pattern for shipping runnable examples
+      alongside a module, and .pre-commit-config.yaml wires fmt/validate/docs generation.
+      Copy the file-layout convention for every IaC layer Groundplan emits.
+    whatToAvoid: >-
+      variables.tf is enormous (the module exposes a very wide surface) — generating it wholesale
+      produces overwhelming scaffolding; select a subset. Oldest last-commit in this set
+      (2026-04-02), though still well inside the maintained window.
+    proposedLayerIds:
+      - iac-terraform-aws-vpc
+      - iac-terraform-module-layout
+      - lint-precommit-terraform
+
+  - name: antonbabenko/pre-commit-terraform
+    url: https://github.com/antonbabenko/pre-commit-terraform
+    stars: 3746
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-16"
+    complexity: standard
+    stack: pre-commit, terraform, bash
+    whatToBorrow: >-
+      Drop-in quality gate for any IaC repo. .pre-commit-hooks.yaml is the hook manifest to
+      adapt, and hooks/terraform_fmt.sh shows the wrapper convention (arg passing, file
+      filtering, per-directory invocation) used across every hook. Pairs directly with the
+      terraform-aws-modules layout layer.
+    whatToAvoid: >-
+      Hooks shell out to external binaries (terraform, tflint, terraform-docs, checkov, trivy)
+      that must be installed separately — generating the config without also generating the
+      tool-install step yields a repo whose hooks all fail on first run.
+    proposedLayerIds:
+      - lint-precommit-terraform
+      - lint-precommit-base
+      - iac-terraform-module-layout
+
+  - name: goreleaser/goreleaser
+    url: https://github.com/goreleaser/goreleaser
+    stars: 15948
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-15"
+    complexity: professional
+    stack: go, github-actions, release
+    whatToBorrow: >-
+      Its own dogfooded config is the artifact worth taking: .goreleaser.yaml covers
+      cross-platform build matrices, archive/checksum/SBOM generation, container manifests and
+      changelog grouping in one declarative file. .github/workflows/build.yml shows the
+      tag-triggered release pipeline that drives it. The best available template for a
+      "cut a real release" layer.
+    whatToAvoid: >-
+      Strongly Go-centric — the build section has little meaning for non-Go stacks (use only
+      the release/archive/changelog parts elsewhere). The project has a paid Pro tier and some
+      documented features are Pro-only; verify a directive is OSS before generating it.
+    proposedLayerIds:
+      - release-goreleaser
+      - release-changelog
+      - supply-chain-sbom
+      - ci-github-actions
+
+  - name: cachix/devenv
+    url: https://github.com/cachix/devenv
+    stars: 7144
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-17"
+    complexity: professional
+    stack: nix, devenv
+    whatToBorrow: >-
+      The most approachable Nix-based reproducible dev environment. Root devenv.nix and
+      flake.nix show the entry-point pair; examples/rust/devenv.nix is a concise per-language
+      environment (toolchain pin, packages, scripts, enterShell hooks). Borrow the
+      languages.* / services.* / scripts.* declaration shape as the model for a
+      language-agnostic dev-env layer.
+    whatToAvoid: >-
+      Hard Nix dependency — this imposes a real learning curve and a multi-GB store on anyone
+      who has not opted into Nix; do not make it a default layer. Ties into Cachix's hosted
+      binary cache, which is a soft vendor pull. Fast-moving schema: options have churned
+      across releases, so pin the devenv version in generated files.
+    proposedLayerIds:
+      - nix-devenv
+      - nix-flake-base
+      - devenv-services-postgres
+
+  - name: fluxcd/flux2-kustomize-helm-example
+    url: https://github.com/fluxcd/flux2-kustomize-helm-example
+    stars: 1280
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-08"
+    complexity: professional
+    stack: kubernetes, flux, kustomize, helm, gitops
+    whatToBorrow: >-
+      The canonical GitOps monorepo layout, and the single most directly reusable directory
+      structure in this category: clusters/staging/ and clusters/production/ hold per-cluster
+      entrypoints (infrastructure.yaml, apps.yaml) that point at shared apps/base/ and
+      infrastructure/ trees, with environment differences expressed only as Kustomize
+      overlays. Verified: clusters/production/infrastructure.yaml,
+      apps/base/podinfo/release.yaml (HelmRelease), apps/staging/podinfo-values.yaml,
+      infrastructure/controllers/kustomization.yaml, infrastructure/configs/kustomization.yaml.
+      Note the path is infrastructure/controllers/, NOT infrastructure/controllers/production/.
+    whatToAvoid: >-
+      Commits you to Flux specifically — the repo shape does not transfer cleanly to Argo CD.
+      It assumes a multi-cluster staging/production split that is overkill for a single
+      environment. Bootstrap requires cluster admin plus a Git write token, so the generated
+      repo is not runnable without out-of-band setup.
+    proposedLayerIds:
+      - gitops-flux
+      - k8s-manifests-kustomize
+      - k8s-overlays-staging-prod
+      - helm-release-flux
+
+  - name: terraform-aws-modules/terraform-aws-eks
+    url: https://github.com/terraform-aws-modules/terraform-aws-eks
+    stars: 4985
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-06-24"
+    complexity: professional
+    stack: terraform, aws, kubernetes
+    whatToBorrow: >-
+      The standard way to stand up EKS in Terraform. modules/eks-managed-node-group/main.tf is
+      a strong sub-module encapsulation example (how to split a large module into composable
+      children), and examples/karpenter/main.tf is a current, working autoscaling reference.
+      The root main.tf shows IRSA and cluster add-on wiring worth adapting.
+    whatToAvoid: >-
+      Very large and opinionated — full generation produces hundreds of lines a beginner cannot
+      audit. Tracks upstream EKS closely, so pinned module versions age fast and major bumps
+      carry breaking variable renames. AWS-only, no abstraction over other clouds.
+    proposedLayerIds:
+      - iac-terraform-aws-eks
+      - iac-terraform-aws-vpc
+      - k8s-autoscaling-karpenter
+      - iac-terraform-module-layout
+
+  - name: slsa-framework/slsa-github-generator
+    url: https://github.com/slsa-framework/slsa-github-generator
+    stars: 587
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-03-09"
+    complexity: enterprise
+    stack: github-actions, supply-chain, sigstore
+    whatToBorrow: >-
+      Build provenance for regulated contexts. .github/workflows/generator_generic_slsa3.yml is
+      a reusable workflow you call with `uses:` to emit signed SLSA level 3 provenance for
+      arbitrary artifacts; .github/workflows/builder_go_slsa3.yml is the language-specific
+      builder variant. The reusable-workflow-as-published-API pattern is itself the thing to
+      copy for Groundplan's CI layers.
+    whatToAvoid: >-
+      Lowest star count here (587) and the least recent commit (2026-03-09) — verify it is
+      still current before committing a template to it. Deep coupling to GitHub OIDC and
+      Sigstore, so it is unusable on other CI providers. Genuine complexity: only justified
+      when provenance is an actual compliance requirement, not by default.
+    proposedLayerIds:
+      - supply-chain-slsa
+      - supply-chain-provenance
+      - supply-chain-sigstore
+      - ci-reusable-workflow
+
+  - name: aws-ia/terraform-aws-eks-blueprints
+    url: https://github.com/aws-ia/terraform-aws-eks-blueprints
+    stars: 3027
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-07"
+    complexity: enterprise
+    stack: terraform, aws, kubernetes
+    whatToBorrow: >-
+      AWS-maintained reference architectures rather than a module. patterns/karpenter/main.tf
+      and patterns/blue-green-upgrade/README.md are the standouts — the blue/green cluster
+      upgrade pattern is genuinely hard-won operational knowledge worth adapting for an
+      enterprise upgrade-strategy layer. Composes terraform-aws-modules/terraform-aws-eks
+      rather than replacing it, so the two layer cleanly together.
+    whatToAvoid: >-
+      The project deliberately narrowed scope (add-on management was split out to separate
+      repos), so older tutorials reference modules no longer here — do not trust external
+      guides. Each pattern provisions real, costly AWS infrastructure. AWS-only by design.
+    proposedLayerIds:
+      - iac-terraform-aws-eks
+      - k8s-autoscaling-karpenter
+      - k8s-blue-green-upgrade
+      - iac-reference-architecture
+
+  - name: prometheus-operator/kube-prometheus
+    url: https://github.com/prometheus-operator/kube-prometheus
+    stars: 7695
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    complexity: enterprise
+    stack: kubernetes, prometheus, grafana, jsonnet
+    whatToBorrow: >-
+      The end-to-end cluster monitoring stack. manifests/ holds ~100 pre-rendered YAML files
+      (manifests/prometheus-prometheus.yaml et al) that can be vendored directly with no
+      jsonnet toolchain at all — that is the pragmatic path. jsonnet/kube-prometheus/main.libsonnet
+      plus examples/all-namespaces.jsonnet show the parameterized generation model if you want
+      customization. Most actively maintained repo in this set.
+    whatToAvoid: >-
+      Heavy: full install is a large resource footprint, too much for small clusters. Real
+      customization means learning jsonnet/jsonnet-bundler, a steep and niche toolchain — avoid
+      by consuming the rendered manifests/ instead. Kubernetes version compatibility is a
+      strict matrix; pin to a release tag matching the target cluster rather than tracking main.
+    proposedLayerIds:
+      - observability-kube-prometheus
+      - observability-grafana-dashboards
+      - k8s-manifests-base
+      - observability-alerting-rules
+
+droppedCandidates:
+  - "hashicorp/terraform — license changed to BUSL-1.1 (source-available, not OSS); excluded."
+  - "opentofu/opentofu — verified MPL-2.0 from LICENSE text; reference-only, cannot vendor files. Also a tool repo rather than template material."
+  - "the-nix-way/dev-templates — verified MPL-2.0 (commonly misremembered as MIT); reference-only. cachix/devenv covers the same Nix dev-env need under Apache-2.0."
+  - "hadolint/hadolint — GPL-3.0; excluded, would force copyleft onto generated repos."
+  - "renovatebot/renovate — AGPL-3.0; excluded for vendoring. A generated renovate.json config is still fine (config is not derived work)."
+  - "helmfile/helmfile — MIT and maintained, but has no example helmfile.yaml at the probed paths; thin as template source material."
+  - "Azure/terraform-azurerm-caf-enterprise-scale — MIT, maintained, but oldest activity in the shortlist (2026-01-05) and Microsoft is steering users toward Azure Verified Modules. Reconsider next pass; leaves this catalog with no Azure landing-zone coverage."
+  - "step-security/harden-runner — Apache-2.0, active (2026-07-07), but a single action.yml; too thin to be a template layer on its own. Worth folding into a CI hardening layer."
+  - "bitnami/charts — Apache-2.0 and active, but the 2025 move of the public catalog to bitnamilegacy means charts reference images whose availability/terms shifted. Chart structure is exemplary; image defaults are a trap."
+  - "super-linter/super-linter — MIT, active (2026-07-17), solid drop-in lint layer; cut only to stay within the entry budget. Strong candidate for a future lint-super-linter layer."
+  - "argoproj/argo-cd — Apache-2.0, active; manifests/install.yaml and manifests/ha/install.yaml are useful, but it is a tool repo. Add if an Argo GitOps alternative to Flux is wanted."
+  - "kubernetes-sigs/kustomize, pulumi/examples, googleapis/release-please — all permissive and active, held back as second-tier for this category."