@sylix/coworker 2.0.10 → 2.0.12

package/dist/skills/defaults/devops/deployment-pipeline-design.md

@@ -0,0 +1,356 @@
+---
+name: deployment-pipeline-design
+description: Design multi-stage CI/CD pipelines with approval gates, security checks, and deployment orchestration. Use when architecting deployment workflows, setting up continuous delivery, or implementing GitOps practices.
+---
+
+# Deployment Pipeline Design
+
+Architecture patterns for multi-stage CI/CD pipelines with approval gates and deployment strategies.
+
+## Purpose
+
+Design robust, secure deployment pipelines that balance speed with safety through proper stage organization and approval workflows.
+
+## When to Use
+
+- Design CI/CD architecture
+- Implement deployment gates
+- Configure multi-environment pipelines
+- Establish deployment best practices
+- Implement progressive delivery
+
+## Pipeline Stages
+
+### Standard Pipeline Flow
+
+```
+┌─────────┐   ┌──────┐   ┌─────────┐   ┌────────┐   ┌──────────┐
+│  Build  │ → │ Test │ → │ Staging │ → │ Approve│ → │Production│
+└─────────┘   └──────┘   └─────────┘   └────────┘   └──────────┘
+```
+
+### Detailed Stage Breakdown
+
+1. **Source** - Code checkout
+2. **Build** - Compile, package, containerize
+3. **Test** - Unit, integration, security scans
+4. **Staging Deploy** - Deploy to staging environment
+5. **Integration Tests** - E2E, smoke tests
+6. **Approval Gate** - Manual approval required
+7. **Production Deploy** - Canary, blue-green, rolling
+8. **Verification** - Health checks, monitoring
+9. **Rollback** - Automated rollback on failure
+
+## Approval Gate Patterns
+
+### Pattern 1: Manual Approval
+
+```yaml
+# GitHub Actions
+production-deploy:
+  needs: staging-deploy
+  environment:
+    name: production
+    url: https://app.example.com
+  runs-on: ubuntu-latest
+  steps:
+    - name: Deploy to production
+      run: |
+        # Deployment commands
+```
+
+### Pattern 2: Time-Based Approval
+
+```yaml
+# GitLab CI
+deploy:production:
+  stage: deploy
+  script:
+    - deploy.sh production
+  environment:
+    name: production
+  when: delayed
+  start_in: 30 minutes
+  only:
+    - main
+```
+
+### Pattern 3: Multi-Approver
+
+```yaml
+# Azure Pipelines
+stages:
+  - stage: Production
+    dependsOn: Staging
+    jobs:
+      - deployment: Deploy
+        environment:
+          name: production
+          resourceType: Kubernetes
+        strategy:
+          runOnce:
+            preDeploy:
+              steps:
+                - task: ManualValidation@0
+                  inputs:
+                    notifyUsers: "team-leads@example.com"
+                    instructions: "Review staging metrics before approving"
+```
+
+## Deployment Strategies
+
+### 1. Rolling Deployment
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: my-app
+spec:
+  replicas: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 2
+      maxUnavailable: 1
+```
+
+**Characteristics:**
+
+- Gradual rollout
+- Zero downtime
+- Easy rollback
+- Best for most applications
+
+### 2. Blue-Green Deployment
+
+```yaml
+# Blue (current)
+kubectl apply -f blue-deployment.yaml
+kubectl label service my-app version=blue
+
+# Green (new)
+kubectl apply -f green-deployment.yaml
+# Test green environment
+kubectl label service my-app version=green
+
+# Rollback if needed
+kubectl label service my-app version=blue
+```
+
+**Characteristics:**
+
+- Instant switchover
+- Easy rollback
+- Doubles infrastructure cost temporarily
+- Good for high-risk deployments
+
+### 3. Canary Deployment
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Rollout
+metadata:
+  name: my-app
+spec:
+  replicas: 10
+  strategy:
+    canary:
+      steps:
+        - setWeight: 10
+        - pause: { duration: 5m }
+        - setWeight: 25
+        - pause: { duration: 5m }
+        - setWeight: 50
+        - pause: { duration: 5m }
+        - setWeight: 100
+```
+
+**Characteristics:**
+
+- Gradual traffic shift
+- Risk mitigation
+- Real user testing
+- Requires service mesh or similar
+
+### 4. Feature Flags
+
+```python
+from flagsmith import Flagsmith
+
+flagsmith = Flagsmith(environment_key="API_KEY")
+
+if flagsmith.has_feature("new_checkout_flow"):
+    # New code path
+    process_checkout_v2()
+else:
+    # Existing code path
+    process_checkout_v1()
+```
+
+**Characteristics:**
+
+- Deploy without releasing
+- A/B testing
+- Instant rollback
+- Granular control
+
+## Pipeline Orchestration
+
+### Multi-Stage Pipeline Example
+
+```yaml
+name: Production Pipeline
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build application
+        run: make build
+      - name: Build Docker image
+        run: docker build -t myapp:${{ github.sha }} .
+      - name: Push to registry
+        run: docker push myapp:${{ github.sha }}
+
+  test:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Unit tests
+        run: make test
+      - name: Security scan
+        run: trivy image myapp:${{ github.sha }}
+
+  deploy-staging:
+    needs: test
+    runs-on: ubuntu-latest
+    environment:
+      name: staging
+    steps:
+      - name: Deploy to staging
+        run: kubectl apply -f k8s/staging/
+
+  integration-test:
+    needs: deploy-staging
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run E2E tests
+        run: npm run test:e2e
+
+  deploy-production:
+    needs: integration-test
+    runs-on: ubuntu-latest
+    environment:
+      name: production
+    steps:
+      - name: Canary deployment
+        run: |
+          kubectl apply -f k8s/production/
+          kubectl argo rollouts promote my-app
+
+  verify:
+    needs: deploy-production
+    runs-on: ubuntu-latest
+    steps:
+      - name: Health check
+        run: curl -f https://app.example.com/health
+      - name: Notify team
+        run: |
+          curl -X POST ${{ secrets.SLACK_WEBHOOK }} \
+            -d '{"text":"Production deployment successful!"}'
+```
+
+## Pipeline Best Practices
+
+1. **Fail fast** - Run quick tests first
+2. **Parallel execution** - Run independent jobs concurrently
+3. **Caching** - Cache dependencies between runs
+4. **Artifact management** - Store build artifacts
+5. **Environment parity** - Keep environments consistent
+6. **Secrets management** - Use secret stores (Vault, etc.)
+7. **Deployment windows** - Schedule deployments appropriately
+8. **Monitoring integration** - Track deployment metrics
+9. **Rollback automation** - Auto-rollback on failures
+10. **Documentation** - Document pipeline stages
+
+## Rollback Strategies
+
+### Automated Rollback
+
+```yaml
+deploy-and-verify:
+  steps:
+    - name: Deploy new version
+      run: kubectl apply -f k8s/
+
+    - name: Wait for rollout
+      run: kubectl rollout status deployment/my-app
+
+    - name: Health check
+      id: health
+      run: |
+        for i in {1..10}; do
+          if curl -sf https://app.example.com/health; then
+            exit 0
+          fi
+          sleep 10
+        done
+        exit 1
+
+    - name: Rollback on failure
+      if: failure()
+      run: kubectl rollout undo deployment/my-app
+```
+
+### Manual Rollback
+
+```bash
+# List revision history
+kubectl rollout history deployment/my-app
+
+# Rollback to previous version
+kubectl rollout undo deployment/my-app
+
+# Rollback to specific revision
+kubectl rollout undo deployment/my-app --to-revision=3
+```
+
+## Monitoring and Metrics
+
+### Key Pipeline Metrics
+
+- **Deployment Frequency** - How often deployments occur
+- **Lead Time** - Time from commit to production
+- **Change Failure Rate** - Percentage of failed deployments
+- **Mean Time to Recovery (MTTR)** - Time to recover from failure
+- **Pipeline Success Rate** - Percentage of successful runs
+- **Average Pipeline Duration** - Time to complete pipeline
+
+### Integration with Monitoring
+
+```yaml
+- name: Post-deployment verification
+  run: |
+    # Wait for metrics stabilization
+    sleep 60
+
+    # Check error rate
+    ERROR_RATE=$(curl -s "$PROMETHEUS_URL/api/v1/query?query=rate(http_errors_total[5m])" | jq '.data.result[0].value[1]')
+
+    if (( $(echo "$ERROR_RATE > 0.01" | bc -l) )); then
+      echo "Error rate too high: $ERROR_RATE"
+      exit 1
+    fi
+```
+
+## Related Skills
+
+- `github-actions-templates` - For GitHub Actions implementation
+- `gitlab-ci-patterns` - For GitLab CI implementation
+- `secrets-management` - For secrets handling

package/dist/skills/defaults/devops/docker.md

@@ -0,0 +1,281 @@
+---
+name: docker
+description: Master Docker for containerization, multi-stage builds, and production deployment.
+---
+
+# Docker Best Practices — CoWorker Edition
+
+Build efficient, secure Docker containers.
+
+## When to Use This Skill
+
+- Containerizing applications
+- Writing Dockerfiles
+- Docker Compose for development
+- Production deployments
+
+## Core Concepts
+
+### 1. Multi-Stage Builds
+
+```dockerfile
+# Build stage
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+# Install dependencies first (better caching)
+COPY package*.json ./
+RUN npm ci
+
+# Copy source and build
+COPY . .
+RUN npm run build
+
+# Production stage
+FROM node:20-alpine AS runner
+
+WORKDIR /app
+
+# Create non-root user
+RUN addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 nodejs
+
+# Copy only what we need
+COPY --from=builder --chown=nodejs:nodejs /app/dist ./dist
+COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
+
+USER nodejs
+
+ENV NODE_ENV=production
+
+EXPOSE 3000
+
+CMD ["node", "dist/index.js"]
+```
+
+### 2. Python Multi-Stage
+
+```dockerfile
+# Build stage
+FROM python:3.11-slim AS builder
+
+WORKDIR /app
+
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    libpq-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Virtual environment
+RUN python -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Production stage
+FROM python:3.11-slim AS runner
+
+WORKDIR /app
+
+# Copy virtual environment
+COPY --from=builder /opt/venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+# Non-root user
+RUN useradd --create-home appuser
+USER appuser
+
+COPY --chown=appuser:appuser . .
+
+EXPOSE 8000
+
+CMD ["uvicorn", "main:app", "--host", "0.0.0.0"]
+```
+
+### 3. Docker Compose for Development
+
+```yaml
+version: '3.8'
+
+services:
+  app:
+    build:
+      context: .
+      target: development
+    volumes:
+      - .:/app
+      - /app/node_modules
+    ports:
+      - "3000:3000"
+    environment:
+      - NODE_ENV=development
+      - DATABASE_URL=postgres://user:pass@db:5432/devdb
+    depends_on:
+      db:
+        condition: service_healthy
+      redis:
+        condition: service_started
+
+  db:
+    image: postgres:15-alpine
+    environment:
+      POSTGRES_USER: user
+      POSTGRES_PASSWORD: pass
+      POSTGRES_DB: devdb
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U user"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+  redis:
+    image: redis:7-alpine
+    command: redis-server --appendonly yes
+    volumes:
+      - redis_data:/data
+
+volumes:
+  postgres_data:
+  redis_data:
+```
+
+### 4. Security Best Practices
+
+```dockerfile
+# Don't use latest tag
+FROM node:20-alpine
+
+# Create non-root user
+RUN adduser -D -g '' appuser
+
+# Use specific versions
+RUN npm ci --production
+
+# Set ownership
+COPY --chown=appuser:appuser . .
+
+USER appuser
+
+# Read-only filesystem (if possible)
+# docker run --read-only ...
+
+# No secrets in image
+# Use runtime environment variables or secrets
+```
+
+### 5. Health Checks
+
+```dockerfile
+FROM node:20-alpine
+
+WORKDIR /app
+
+COPY --chown=nodejs:nodejs package*.json ./
+RUN npm ci --only=production
+
+COPY --chown=nodejs:nodejs . .
+
+USER nodejs
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD node -e "require('http').get('http://localhost:3000/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"
+
+EXPOSE 3000
+
+CMD ["node", "server.js"]
+```
+
+### 6. Optimizing Image Size
+
+```dockerfile
+# Use alpine base
+FROM node:20-alpine
+
+# Don't copy unnecessary files
+.dockerignore:
+# node_modules
+# .git
+# *.md
+# tests/
+# .env*
+
+# Use multi-stage builds (see above)
+# Combine RUN statements
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# Clean up in same layer
+RUN npm ci --production && \
+    npm cache clean --force
+```
+
+### 7. Production Deployment
+
+```yaml
+# docker-compose.production.yml
+version: '3.8'
+
+services:
+  app:
+    image: myapp:${VERSION:-latest}
+    restart: unless-stopped
+    ports:
+      - "3000:3000"
+    environment:
+      - NODE_ENV=production
+      - DATABASE_URL=${DATABASE_URL}
+      - REDIS_URL=${REDIS_URL}
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+    deploy:
+      resources:
+        limits:
+          cpus: '1'
+          memory: 1G
+        reservations:
+          cpus: '0.5'
+          memory: 512M
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+    networks:
+      - frontend
+      - backend
+
+networks:
+  frontend:
+  backend:
+    internal: true
+```
+
+## Best Practices
+
+1. **Multi-stage builds** - Smaller images
+2. **Specific versions** - No latest
+3. **Non-root user** - Security
+4. **.dockerignore** - Exclude files
+5. **Layer caching** - Order wisely
+6. **Health checks** - Container health
+7. **Healthchecks** - Production readiness
+
+## Common Mistakes
+
+- Using `latest` tag
+- Running as root
+- No .dockerignore
+- Copying all files
+- Not using multi-stage
+- No health checks
+- Large image sizes