@slamb2k/mad-skills 2.0.54 → 2.0.56

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "mad-skills",
   "description": "AI-assisted planning, development and governance tools",
-  "version": "2.0.54",
+  "version": "2.0.56",
   "author": {
     "name": "slamb2k",
     "url": "https://github.com/slamb2k"

package/hooks/lib/banner.cjs

@@ -2,28 +2,61 @@
 
 const config = require('./config.cjs');
 
+// Unicode banner (Delta Corps Priest 1) — used when the terminal supports UTF-8.
 // prettier-ignore
-const BANNER_LINES = [
-  '::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::',
-  ":::::'##::::'##::::'###::::'########::::::'######::'##:::'##:'####:'##:::::::'##::::::::'######::::::::",
-  "::::: ###::'###:::'## ##::: ##.... ##::::'##... ##: ##::'##::. ##:: ##::::::: ##:::::::'##... ##:::::::",
-  "::::: ####'####::'##:. ##:: ##:::: ##:::: ##:::..:: ##:'##:::: ##:: ##::::::: ##::::::: ##:::..::::::::",
-  "::::: ## ### ##:'##:::. ##: ##:::: ##::::. ######:: #####::::: ##:: ##::::::: ##:::::::. ######::::::::",
-  "::::: ##. #: ##: #########: ##:::: ##:::::..... ##: ##. ##:::: ##:: ##::::::: ##::::::::..... ##:::::::",
-  "::::: ##:.:: ##: ##.... ##: ##:::: ##::::'##::: ##: ##:. ##::: ##:: ##::::::: ##:::::::'##::: ##:::::::",
-  "::::: ##:::: ##: ##:::: ##: ########:::::. ######:: ##::. ##:'####: ########: ########:. ######::::::::",
-  "::::::..:::::..::..:::::..::........:::::::......:::..::::..::....::........::........:::......:::::::::",
+const BANNER_UNICODE = [
+  "  ▄▄▄▄███▄▄▄▄      ▄████████ ████████▄",
+  "▄██▀▀▀███▀▀▀██▄   ███    ███ ███   ▀███",
+  "███   ███   ███   ███    ███ ███    ███",
+  "███   ███   ███   ███    ███ ███    ███",
+  "███   ███   ███ ▀███████████ ███    ███",
+  "███   ███   ███   ███    ███ ███    ███",
+  "███   ███   ███   ███    ███ ███   ▄███",
+  " ▀█   ███   █▀    ███    █▀  ████████▀",
+  "",
+  "   ▄████████    ▄█   ▄█▄  ▄█   ▄█        ▄█          ▄████████",
+  "  ███    ███   ███ ▄███▀ ███  ███       ███         ███    ███",
+  "  ███    █▀    ███▐██▀   ███▌ ███       ███         ███    █▀",
+  "  ███         ▄█████▀    ███▌ ███       ███         ███",
+  "▀███████████ ▀▀█████▄    ███▌ ███       ███       ▀███████████",
+  "         ███   ███▐██▄   ███  ███       ███                ███",
+  "   ▄█    ███   ███ ▀███▄ ███  ███▌    ▄ ███▌    ▄    ▄█    ███",
+  " ▄████████▀    ███   ▀█▀ █▀   █████▄▄██ █████▄▄██  ▄████████▀",
+  "               ▀              ▀         ▀",
 ];
 
-const SEPARATOR = '\u2500'.repeat(70);
+// ASCII fallback (Rowan Cap) — used when the terminal locale is not UTF-8.
+// prettier-ignore
+const BANNER_ASCII = [
+  "    dMMMMMMMMb  .aMMMb  dMMMMb",
+  "   dMP\"dMP\"dMP dMP\"dMP dMP VMP",
+  "  dMP dMP dMP dMMMMMP dMP dMP",
+  " dMP dMP dMP dMP dMP dMP.aMP",
+  "dMP dMP dMP dMP dMP dMMMMP\"",
+  "",
+  "   .dMMMb  dMP dMP dMP dMP     dMP    .dMMMb",
+  "  dMP\" VP dMP.dMP amr dMP     dMP    dMP\" VP",
+  "  VMMMb  dMMMMK\" dMP dMP     dMP     VMMMb",
+  "dP .dMP dMP\"AMF dMP dMP     dMP    dP .dMP",
+  "VMMMP\" dMP dMP dMP dMMMMMP dMMMMMP VMMMP\"",
+];
+
+// True when the terminal locale advertises UTF-8, so box-drawing glyphs render.
+function supportsUnicode() {
+  const locale = process.env.LC_ALL || process.env.LC_CTYPE || process.env.LANG || '';
+  return /utf-?8/i.test(locale);
+}
 
 function getBanner() {
+  const unicode = supportsUnicode();
+  const lines = unicode ? BANNER_UNICODE : BANNER_ASCII;
+  const separator = (unicode ? '─' : '-').repeat(70);
   return [
-    ...BANNER_LINES,
-    SEPARATOR,
+    ...lines,
+    separator,
     ` Session Guard v${config.version}`,
-    SEPARATOR,
+    separator,
   ].join('\n');
 }
 
-module.exports = { getBanner, BANNER_MARKER: '::::::::::::::::::::' };
+module.exports = { getBanner, supportsUnicode, BANNER_MARKER: 'Session Guard' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@slamb2k/mad-skills",
-  "version": "2.0.54",
+  "version": "2.0.56",
   "description": "Claude Code skills collection — full lifecycle development tools",
   "type": "module",
   "repository": {

package/skills/dock/SKILL.md

@@ -280,6 +280,14 @@ with development overrides (volume mounts, hot reload, debug ports).
 Detect CI system from Phase 1 (GitHub Actions / Azure Pipelines / GitLab CI).
 Read the appropriate template from `references/pipeline-templates.md`.
 
+For GitHub Actions and Azure Pipelines, the templates are **hardened by default**
+— read `references/hardening.md` for the OIDC auth, keyless cosign signing,
+idempotency guards, and digest-pinned promotion these templates implement. The
+generated workflow MUST include `id-token: write`, `provenance: true`, a cosign
+`sign` in the build job and `verify` in every promotion job, an existence guard
+before build, and deploy steps that reference the image by `@sha256:` digest.
+(GitLab CI remains credential-based.)
+
 Generate a workflow that implements:
 
 **On pull request:**
@@ -349,6 +357,14 @@ If the detected framework doesn't already have a health endpoint, add a comment
 in the generated workflow noting that a `/healthz` or `/health` endpoint is
 recommended for deployment readiness probes.
 
+### 3.7 — Deployment Setup Guide (deploy/SETUP.md)
+
+Because the pipelines are secure by default, first-run requires one-time
+cloud-side trust. Generate `deploy/SETUP.md` from the **Generated deploy/SETUP.md**
+section of `references/hardening.md`, substituting the target repo (`OWNER/REPO`),
+chosen registry, and cloud identifiers. This file lists the federated-credential
+/ IAM-trust steps and the cosign verification command.
+
 ---
 
 ## Phase 4: Verify
@@ -366,6 +382,10 @@ Also validate generated workflow files:
 - GitHub Actions: check YAML syntax
 - Azure Pipelines: check YAML syntax
 - GitLab CI: check YAML syntax
+- For the GitHub workflow, confirm it sets `id-token: write`; for Azure Pipelines,
+  confirm it authenticates via a Workload Identity Federation service connection
+  (`azureSubscription`). Both must contain a cosign `sign`+`verify` pair and
+  reference deploy images by `@sha256:` digest. Flag any absence as a generation error.
 
 Present the user with a summary of all generated files before writing.
 
@@ -396,6 +416,11 @@ After all files are generated and verified, present:
 │     Merge → build + test → push → deploy dev → smoke
 │     Tag   → retag (no rebuild) → staging → e2e → prod
 │
+│  🔐 Required cloud setup
+│     • Configure federated identity (see deploy/SETUP.md)
+│     • {registry-specific: IAM role / ACR federated cred / GCP WIP}
+│     • First run fails until trust is configured — this is expected
+│
 │  🔗 Links
 │     Dockerfile:  {path}
 │     Workflow:    {path}

package/skills/dock/references/hardening.md

@@ -0,0 +1,104 @@
+# Pipeline Hardening Reference
+
+How `/dock` hardens the pipelines it generates. These patterns mirror
+mad-skills' own release workflow, translated from npm publishing to OCI
+containers. Hardened is the only mode for GitHub Actions and Azure Pipelines.
+
+## OIDC Registry Auth
+
+Never store long-lived cloud registry credentials in CI. Authenticate with the
+CI provider's OIDC identity, federated to a cloud role/identity.
+
+- **GHCR** — keep the ephemeral `GITHUB_TOKEN` (already short-lived, OIDC-backed).
+  Requires `permissions: packages: write`.
+- **AWS ECR** — `aws-actions/configure-aws-credentials@v4` with `role-to-assume`
+  (an IAM role trusting the GitHub OIDC provider). No access keys.
+- **Azure ACR** — `azure/login@v2` with Workload Identity Federation
+  (`client-id` + `tenant-id` + `subscription-id`, federated credential scoped to
+  the repo). No client secret. Then `az acr login`.
+- **Google Artifact Registry** — `google-github-actions/auth@v2` with a Workload
+  Identity Provider + service account. No SA key JSON.
+
+All jobs that need OIDC set `permissions: id-token: write` (plus
+`contents: read`). Azure Pipelines uses a **Workload Identity Federation service
+connection** (`azureSubscription:`) instead of a stored password.
+
+## Signing & Provenance
+
+- Build with `provenance: true` and `sbom: true` (buildx emits SLSA provenance +
+  SBOM attestations attached to the image).
+- Sign the image **by digest** with keyless cosign (Fulcio certificate + Rekor
+  transparency log, authorized by the `id-token: write` OIDC token — no signing
+  key in secrets).
+- Every promotion job runs `cosign verify` against the digest, asserting the
+  certificate identity matches the workflow's OIDC issuer and
+  `repo:OWNER/REPO`. Verification failure blocks promotion.
+
+> **Private-infra note:** keyless cosign writes to the public Rekor log. Orgs
+> that cannot use public transparency infra can switch to a key pair
+> (`cosign generate-key-pair`, private key in a CI secret,
+> `cosign sign --key`). This is a documented fallback — dock does not generate it.
+
+## Idempotency Guards
+
+- Before build, guard with `crane manifest <ref>` (fallback:
+  `docker manifest inspect`). If the artifact already exists, skip build+push and
+  reuse the existing digest — the container analog of mad-skills' `npm view`
+  publish-guard.
+- Promote/retag steps are check-then-act and tolerate an already-promoted digest
+  ("recovery mode") so a re-run exits cleanly instead of failing.
+- A `concurrency:` group keyed on workflow + ref (`cancel-in-progress`) prevents
+  overlapping release runs from racing.
+
+## Digest-Pinned Promotion
+
+- The build job outputs `IMAGE@sha256:<digest>` as a job output.
+- Dev, staging, and prod deploy by that **digest**, never a mutable tag. Tags
+  like `latest` / `vX.Y.Z` may be attached for humans, but deploys resolve the
+  digest.
+- `deploy/environments.yml` records the deployed digest so the matrix captures
+  exactly what shipped.
+
+## Generated deploy/SETUP.md
+
+`/dock` writes `deploy/SETUP.md` into the target repo, tailored to the chosen
+registry. Template body (substitute `OWNER/REPO`, registry, cloud identifiers):
+
+```markdown
+# Deployment Setup — Required Before First Run
+
+This pipeline uses keyless OIDC and image signing. Complete the cloud-side
+trust below once; no long-lived credentials are stored in CI.
+
+## 1. Federated identity (pick your registry)
+
+### AWS ECR
+- Create an IAM role trusting the GitHub OIDC provider
+  (`token.actions.githubusercontent.com`), condition
+  `token.actions.githubusercontent.com:sub = repo:OWNER/REPO:ref:refs/heads/main`
+  (add tag refs for releases).
+- Attach a policy allowing `ecr:*` push to your repository.
+- Put the role ARN in the workflow `role-to-assume`.
+
+### Azure ACR
+- Register an app / user-assigned managed identity.
+- Add a **federated credential** scoped to `repo:OWNER/REPO` (branch `main` and
+  tag refs), subject `repo:OWNER/REPO:ref:refs/heads/main`.
+- Grant it `AcrPush` on the registry.
+- Set `client-id` / `tenant-id` / `subscription-id` in the workflow.
+
+### Google Artifact Registry
+- Create a Workload Identity Pool + provider for GitHub.
+- Bind a service account with `artifactregistry.writer`, allowing
+  `principalSet://…/attribute.repository/OWNER/REPO`.
+- Set `workload_identity_provider` + `service_account` in the workflow.
+
+## 2. Signing
+
+Keyless cosign needs no setup — it uses the workflow OIDC token and the public
+Rekor log. To verify locally:
+`cosign verify --certificate-identity-regexp 'https://github.com/OWNER/REPO/.*' --certificate-oidc-issuer https://token.actions.githubusercontent.com REGISTRY/IMAGE@sha256:...`
+
+If public transparency logging is not allowed, switch to a key pair (see the
+Signing & Provenance note in the dock hardening reference).
+```

package/skills/dock/references/pipeline-templates.md

@@ -19,12 +19,14 @@ Template variables:
 
 ## GitHub Actions
 
-### Build & Deploy Workflow
+### Build & Deploy Workflow (hardened)
 
-File: `.github/workflows/deploy.yml`
+Placeholders: `{REGISTRY}` (e.g. `ghcr.io/OWNER/REPO`), `{IMAGE_NAME}`.
+GHCR uses the ephemeral `GITHUB_TOKEN`; cloud registries use OIDC (see the
+commented block). Deployment is by digest and gated on signature verification.
 
 ```yaml
-name: Build & Deploy
+name: Release
 
 on:
   pull_request:
@@ -33,8 +35,8 @@ on:
     tags: ["v*"]
 
 concurrency:
-  group: deploy-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 env:
   REGISTRY: {REGISTRY}
@@ -42,155 +44,112 @@ env:
 
 permissions:
   contents: read
-  packages: write
+  packages: write      # GHCR push
+  id-token: write       # OIDC: cloud login + keyless cosign
 
 jobs:
-  # ── Build & Test ──────────────────────────────────────────────
   build:
     runs-on: ubuntu-latest
-    # Skip for release tags — we retag, not rebuild
-    if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
     outputs:
-      image_tag: ${{ steps.meta.outputs.tags }}
-      sha_short: ${{ steps.vars.outputs.sha_short }}
+      image: ${{ steps.digest.outputs.ref }}   # REGISTRY/IMAGE@sha256:...
     steps:
       - uses: actions/checkout@v4
 
-      - name: Set variables
-        id: vars
-        run: echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=sha,prefix=
-            type=ref,event=pr,prefix=pr-
-            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', '{DEFAULT_BRANCH}') }}
-
       - uses: docker/setup-buildx-action@v3
 
-      - name: Login to registry
+      - uses: imjasonh/setup-crane@v0.4
+
+      # Idempotency guard: skip build if this commit's image already exists.
+      - name: Check existing image
+        id: guard
+        run: |
+          TAG="${REGISTRY}/${IMAGE_NAME}:${GITHUB_SHA}"
+          if crane manifest "$TAG" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::$TAG already present — reusing digest."
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      # GHCR login (ephemeral token). For cloud registries, replace with OIDC:
+      #   AWS ECR:  aws-actions/configure-aws-credentials@v4 (role-to-assume) + aws ecr get-login-password
+      #   Azure ACR: azure/login@v2 (WIF client-id/tenant-id/subscription-id) + az acr login
+      #   GAR:      google-github-actions/auth@v2 (workload_identity_provider + service_account) + gcloud auth configure-docker
+      - name: Login to GHCR
+        if: steps.guard.outputs.exists == 'false' && github.event_name == 'push'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and test
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          target: test
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Build and push production image
-        if: github.event_name == 'push'
+      - name: Build and push
+        id: build
+        if: steps.guard.outputs.exists == 'false'
         uses: docker/build-push-action@v6
         with:
           context: .
           target: production
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          push: ${{ github.event_name == 'push' }}
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          provenance: true
+          sbom: true
 
-  # ── Deploy to Dev ─────────────────────────────────────────────
-  deploy-dev:
-    needs: build
-    if: github.ref == 'refs/heads/{DEFAULT_BRANCH}'
-    runs-on: ubuntu-latest
-    environment: dev
-    steps:
-      - uses: actions/checkout@v4
+      - uses: sigstore/cosign-installer@v3
 
-      - name: Deploy to dev
-        run: |
-          # {DEV_DEPLOY_COMMANDS}
-          echo "Deploying ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build.outputs.sha_short }} to dev"
+      - name: Sign image (keyless)
+        if: steps.guard.outputs.exists == 'false' && github.event_name == 'push'
+        run: cosign sign --yes "${REGISTRY}/${IMAGE_NAME}@${{ steps.build.outputs.digest }}"
 
-      - name: Smoke test
+      - name: Resolve digest reference
+        id: digest
         run: |
-          # Poll the health endpoint until ready (bounded deadline so a
-          # genuinely broken deploy still fails fast). Do not use a blind
-          # `sleep N && curl` — it flakes on slow cold starts and wastes
-          # time on fast ones.
-          deadline=$((SECONDS + 120))
-          until curl -fs "$DEV_URL/healthz" >/dev/null; do
-            if [ $SECONDS -ge $deadline ]; then
-              echo "Health check failed to pass within 120s" >&2
-              exit 1
-            fi
-            sleep 2
-          done
-
-  # ── Promote to Staging (on release tag) ───────────────────────
-  promote-staging:
-    if: startsWith(github.ref, 'refs/tags/v')
+          if [ "${{ steps.guard.outputs.exists }}" = "true" ]; then
+            DIG=$(crane digest "${REGISTRY}/${IMAGE_NAME}:${GITHUB_SHA}")
+          else
+            DIG="${{ steps.build.outputs.digest }}"
+          fi
+          echo "ref=${REGISTRY}/${IMAGE_NAME}@${DIG}" >> "$GITHUB_OUTPUT"
+
+  deploy-dev:
+    needs: build
+    if: github.event_name == 'push' && github.ref == 'refs/heads/{DEFAULT_BRANCH}'
     runs-on: ubuntu-latest
-    environment: staging
-    outputs:
-      version: ${{ steps.version.outputs.tag }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Extract version
-        id: version
-        run: echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
-
-      - name: Login to registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Retag image (no rebuild)
+      - uses: sigstore/cosign-installer@v3
+      - name: Verify signature before deploy
         run: |
-          SHA=$(git rev-parse --short HEAD)
-          docker buildx imagetools create \
-            --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }}" \
-            "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${SHA}"
-
-      - name: Deploy to staging
-        run: |
-          # {STAGING_DEPLOY_COMMANDS}
-          echo "Deploying ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }} to staging"
-
-      - name: Run staging tests
-        run: |
-          # Integration and e2e tests against staging
-          echo "Running staging gate tests..."
-
-  # ── Promote to Production ─────────────────────────────────────
-  promote-prod:
-    needs: promote-staging
+          cosign verify \
+            --certificate-identity-regexp "https://github.com/${{ github.repository }}/.*" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            "${{ needs.build.outputs.image }}"
+      - name: Deploy to dev (by digest — never rebuild)
+        run: echo "Deploy ${{ needs.build.outputs.image }} to dev"
+
+  promote:
+    needs: build
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
-    environment: production
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Deploy to production
-        run: |
-          # {PROD_DEPLOY_COMMANDS}
-          echo "Deploying ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.promote-staging.outputs.version }} to production"
-
-      - name: Post-deploy smoke test
+      - uses: sigstore/cosign-installer@v3
+      - name: Verify signature
         run: |
-          # Poll until healthy, bounded deadline. Never `sleep N && curl`.
-          deadline=$((SECONDS + 120))
-          until curl -fs "$PROD_URL/healthz" >/dev/null; do
-            if [ $SECONDS -ge $deadline ]; then
-              echo "Production health check failed to pass within 120s" >&2
-              exit 1
-            fi
-            sleep 2
-          done
+          cosign verify \
+            --certificate-identity-regexp "https://github.com/${{ github.repository }}/.*" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            "${{ needs.build.outputs.image }}"
+      - name: Promote to staging (by digest)
+        run: echo "Deploy ${{ needs.build.outputs.image }} to staging"
+      - name: Promote to prod (by digest)
+        run: echo "Deploy ${{ needs.build.outputs.image }} to prod"
 ```
 
 ### Reusable deploy step patterns
@@ -201,112 +160,80 @@ deployment steps.
 
 ---
 
-## Azure DevOps Pipelines
+## Azure DevOps Pipelines (hardened)
 
-File: `azure-pipelines.yml`
+Uses a **Workload Identity Federation** service connection (`azureSubscription`)
+for keyless ACR auth — no stored registry password. Images are signed and
+deployed by digest.
 
 ```yaml
 trigger:
-  branches:
-    include: [{DEFAULT_BRANCH}]
-  tags:
-    include: ["v*"]
-
-pr:
-  branches:
-    include: [{DEFAULT_BRANCH}]
+  branches: { include: [main] }
+  tags: { include: ["v*"] }
 
 variables:
+  azureSubscription: "<WIF-service-connection-name>"   # Workload Identity Federation
   registry: {REGISTRY}
   imageName: {IMAGE_NAME}
-  vmImageName: ubuntu-latest
 
 stages:
-  # ── Build & Test ──────────────────────────────────────────────
   - stage: Build
-    condition: not(startsWith(variables['Build.SourceBranch'], 'refs/tags/v'))
     jobs:
-      - job: BuildAndTest
-        pool:
-          vmImage: $(vmImageName)
+      - job: BuildSignPush
+        pool: { vmImage: ubuntu-latest }
         steps:
-          - task: Docker@2
-            displayName: Build test image
-            inputs:
-              command: build
-              dockerfile: Dockerfile
-              arguments: --target test -t $(imageName):test
-
-          - task: Docker@2
-            displayName: Build production image
+          - task: AzureCLI@2
+            displayName: ACR login (WorkloadIdentityFederation)
             inputs:
-              command: build
-              dockerfile: Dockerfile
-              arguments: --target production -t $(registry)/$(imageName):$(Build.SourceVersion)
-
-          - task: Docker@2
-            displayName: Push to registry
-            condition: eq(variables['Build.SourceBranch'], 'refs/heads/{DEFAULT_BRANCH}')
-            inputs:
-              command: push
-              containerRegistry: $(dockerRegistryServiceConnection)
-              repository: $(imageName)
-              tags: |
-                $(Build.SourceVersion)
-                latest
-
-  # ── Deploy to Dev ─────────────────────────────────────────────
-  - stage: DeployDev
-    condition: eq(variables['Build.SourceBranch'], 'refs/heads/{DEFAULT_BRANCH}')
+              azureSubscription: $(azureSubscription)
+              scriptType: bash
+              scriptLocation: inlineScript
+              inlineScript: az acr login --name $(echo $(registry) | cut -d. -f1)
+
+          - script: |
+              TAG="$(registry)/$(imageName):$(Build.SourceVersion)"
+              if docker manifest inspect "$TAG" >/dev/null 2>&1; then
+                echo "##vso[task.setvariable variable=exists]true"
+              else
+                echo "##vso[task.setvariable variable=exists]false"
+              fi
+            displayName: Idempotency guard
+
+          - script: |
+              docker buildx build --target production \
+                --provenance=true --sbom=true --push \
+                -t $(registry)/$(imageName):$(Build.SourceVersion) .
+            condition: ne(variables.exists, 'true')
+            displayName: Build, provenance, push
+
+          - script: |
+              DIG=$(docker buildx imagetools inspect $(registry)/$(imageName):$(Build.SourceVersion) --format '{{.Manifest.Digest}}')
+              echo "##vso[task.setvariable variable=digestRef;isOutput=true]$(registry)/$(imageName)@$DIG"
+            name: build
+            displayName: Resolve digest (both paths)
+
+          - script: cosign sign --yes $(build.digestRef)
+            condition: ne(variables.exists, 'true')
+            displayName: Sign image (keyless)
+
+  - stage: Promote
     dependsOn: Build
-    jobs:
-      - deployment: DeployDev
-        environment: dev
-        pool:
-          vmImage: $(vmImageName)
-        strategy:
-          runOnce:
-            deploy:
-              steps:
-                - script: |
-                    echo "Deploying $(registry)/$(imageName):$(Build.SourceVersion) to dev"
-                    # {DEV_DEPLOY_COMMANDS}
-
-  # ── Promote to Staging ────────────────────────────────────────
-  - stage: PromoteStaging
     condition: startsWith(variables['Build.SourceBranch'], 'refs/tags/v')
     jobs:
-      - deployment: DeployStaging
-        environment: staging
-        pool:
-          vmImage: $(vmImageName)
-        strategy:
-          runOnce:
-            deploy:
-              steps:
-                - script: |
-                    TAG=${BUILD_SOURCEBRANCH#refs/tags/}
-                    echo "Retagging and deploying $TAG to staging"
-                    # Retag — do NOT rebuild
-                    # {STAGING_DEPLOY_COMMANDS}
-
-  # ── Promote to Production ─────────────────────────────────────
-  - stage: PromoteProd
-    condition: startsWith(variables['Build.SourceBranch'], 'refs/tags/v')
-    dependsOn: PromoteStaging
-    jobs:
-      - deployment: DeployProd
-        environment: production
-        pool:
-          vmImage: $(vmImageName)
-        strategy:
-          runOnce:
-            deploy:
-              steps:
-                - script: |
-                    TAG=${BUILD_SOURCEBRANCH#refs/tags/}
-                    echo "Deploying $TAG to production"
-                    # {PROD_DEPLOY_COMMANDS}
+      - job: VerifyAndDeploy
+        pool: { vmImage: ubuntu-latest }
+        variables:
+          digestRef: $[ stageDependencies.Build.BuildSignPush.outputs['build.digestRef'] ]
+        steps:
+          # Set identity + issuer to your signing identity — see deploy/SETUP.md.
+          - script: |
+              cosign verify \
+                --certificate-identity-regexp "<CERT_IDENTITY_REGEXP>" \
+                --certificate-oidc-issuer "<OIDC_ISSUER>" \
+                $(digestRef)
+            displayName: Verify signature (by sha256 digest)
+          - script: echo "Deploy $(digestRef) to staging then prod (no rebuild)"
+            displayName: Promote by digest
 ```
 
 ---

package/skills/dock/tests/evals.json

@@ -41,5 +41,15 @@
       { "type": "semantic", "value": "Suggests Azure Container Registry rather than ghcr.io as the default registry" },
       { "type": "semantic", "value": "References Azure Pipelines as the CI system for the generated workflow" }
     ]
+  },
+  {
+    "name": "hardened-pipeline",
+    "prompt": "/dock --skip-interview for a Node.js app deploying to AWS ECR",
+    "assertions": [
+      { "type": "semantic", "value": "Uses OIDC / keyless federated authentication to the container registry rather than stored long-lived credentials" },
+      { "type": "semantic", "value": "Signs the built image (cosign) and verifies the signature before promoting to an environment" },
+      { "type": "semantic", "value": "Promotes images by immutable sha256 digest rather than a mutable tag" },
+      { "type": "semantic", "value": "Generates a deploy/SETUP.md describing the cloud-side federated-identity setup required before first run" }
+    ]
   }
 ]

package/skills/manifest.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-07-02T03:59:12.977Z",
+  "generated": "2026-07-06T03:27:34.322Z",
   "count": 11,
   "skills": [
     {
@@ -36,7 +36,7 @@
       "name": "dock",
       "directory": "dock",
       "description": ">- Generate container-based release pipelines that build once and promote immutable artifacts through environments (dev → staging → prod). Detects your stack, interviews for infrastructure choices, then outputs deterministic CI/CD files (Dockerfile, workflows, deployment manifests) that run without an LLM. Use when setting up deployment pipelines, containerizing an app, creating release workflows, or connecting CI to container-friendly infrastructure (Azure Container Apps, AWS Fargate, Google Cloud Run, Kubernetes, Dokku, Coolify, CapRover, etc.).",
-      "lines": 432,
+      "lines": 457,
       "hasScripts": false,
       "hasReferences": true,
       "hasAssets": false,