agentplugged 1.3.0 → 2.0.0

package/dist/method/skills/setup-ci/assets/stack-go-gitlab.yml

@@ -0,0 +1,63 @@
+# Base CI for Go (go test, go vet, govulncheck): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the merge request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+image: golang:1.23
+
+stages:
+  - check
+
+default:
+  timeout: 30 minutes
+
+lint:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'go vet ./... 2>&1 | tee -a reports/lint.txt'
+    - 'gofmt -l . | tee -a reports/lint.txt'
+    - 'test -z "$(gofmt -l .)"'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+test:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'go test ./... 2>&1 | tee -a reports/test.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+build:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'go build ./... 2>&1 | tee -a reports/build.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+audit:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 2>&1 | tee -a reports/audit.txt'
+    - '$(go env GOPATH)/bin/govulncheck ./... 2>&1 | tee -a reports/audit.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/

package/dist/method/skills/setup-ci/assets/stack-jvm-gradle-github.yml

@@ -0,0 +1,134 @@
+# Base CI for JVM with Gradle (test, check, dependency-check): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the pull request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+# Audit: add the plugin `org.owasp.dependencycheck` to the build; until then this job fails on purpose.
+# Lint: runs the static checks the build declares (checkstyle, spotless...).
+# Audit: without an NVD API key (nvd { apiKey } in the build, from a secret of the forge) the first vulnerability database download is very slow; the audit job allows 30 minutes.
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: gradle
+      - name: lint
+        run: |
+          mkdir -p reports
+          ./gradlew --no-daemon check -x test 2>&1 | tee -a reports/lint.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: lint-evidence
+          path: |
+            reports/
+            build/reports/
+            build/test-results/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: gradle
+      - name: test
+        run: |
+          mkdir -p reports
+          ./gradlew --no-daemon test 2>&1 | tee -a reports/test.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-evidence
+          path: |
+            reports/
+            build/reports/
+            build/test-results/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: gradle
+      - name: build
+        run: |
+          mkdir -p reports
+          ./gradlew --no-daemon assemble 2>&1 | tee -a reports/build.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-evidence
+          path: |
+            reports/
+            build/reports/
+            build/test-results/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  audit:
+    name: audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: gradle
+      - name: audit
+        run: |
+          mkdir -p reports
+          ./gradlew --no-daemon dependencyCheckAnalyze 2>&1 | tee -a reports/audit.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: audit-evidence
+          path: |
+            reports/
+            build/reports/
+            build/test-results/
+          if-no-files-found: ignore
+          retention-days: 14

package/dist/method/skills/setup-ci/assets/stack-jvm-gradle-gitlab.yml

@@ -0,0 +1,71 @@
+# Base CI for JVM with Gradle (test, check, dependency-check): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the merge request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+# Audit: add the plugin `org.owasp.dependencycheck` to the build; until then this job fails on purpose.
+# Lint: runs the static checks the build declares (checkstyle, spotless...).
+# Audit: without an NVD API key (nvd { apiKey } in the build, from a secret of the forge) the first vulnerability database download is very slow; the audit job allows 30 minutes.
+image: gradle:8-jdk21
+
+stages:
+  - check
+
+default:
+  timeout: 30 minutes
+
+lint:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - './gradlew --no-daemon check -x test 2>&1 | tee -a reports/lint.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+      - build/reports/
+      - build/test-results/
+
+test:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - './gradlew --no-daemon test 2>&1 | tee -a reports/test.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+      - build/reports/
+      - build/test-results/
+
+build:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - './gradlew --no-daemon assemble 2>&1 | tee -a reports/build.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+      - build/reports/
+      - build/test-results/
+
+audit:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - './gradlew --no-daemon dependencyCheckAnalyze 2>&1 | tee -a reports/audit.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+      - build/reports/
+      - build/test-results/

package/dist/method/skills/setup-ci/assets/stack-jvm-maven-github.yml

@@ -0,0 +1,133 @@
+# Base CI for JVM with Maven (surefire, checkstyle, dependency-check): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the pull request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+# Lint: starts on the Google checkstyle rules; point it at your own configuration if you have one.
+# Audit: without an NVD API key (a secret of the forge, passed as -DnvdApiKey=...) the first vulnerability database download is very slow; the audit job allows 30 minutes.
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: maven
+      - name: lint
+        run: |
+          mkdir -p reports
+          mvn -B checkstyle:check -Dcheckstyle.config.location=google_checks.xml -Dcheckstyle.violationSeverity=warning 2>&1 | tee -a reports/lint.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: lint-evidence
+          path: |
+            reports/
+            target/surefire-reports/
+            target/dependency-check-report.html
+          if-no-files-found: ignore
+          retention-days: 14
+
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: maven
+      - name: test
+        run: |
+          mkdir -p reports
+          mvn -B test 2>&1 | tee -a reports/test.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-evidence
+          path: |
+            reports/
+            target/surefire-reports/
+            target/dependency-check-report.html
+          if-no-files-found: ignore
+          retention-days: 14
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: maven
+      - name: build
+        run: |
+          mkdir -p reports
+          mvn -B -DskipTests package 2>&1 | tee -a reports/build.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-evidence
+          path: |
+            reports/
+            target/surefire-reports/
+            target/dependency-check-report.html
+          if-no-files-found: ignore
+          retention-days: 14
+
+  audit:
+    name: audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: maven
+      - name: audit
+        run: |
+          mkdir -p reports
+          mvn -B org.owasp:dependency-check-maven:12.1.0:check -DfailBuildOnCVSS=7 2>&1 | tee -a reports/audit.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: audit-evidence
+          path: |
+            reports/
+            target/surefire-reports/
+            target/dependency-check-report.html
+          if-no-files-found: ignore
+          retention-days: 14

package/dist/method/skills/setup-ci/assets/stack-jvm-maven-gitlab.yml

@@ -0,0 +1,70 @@
+# Base CI for JVM with Maven (surefire, checkstyle, dependency-check): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the merge request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+# Lint: starts on the Google checkstyle rules; point it at your own configuration if you have one.
+# Audit: without an NVD API key (a secret of the forge, passed as -DnvdApiKey=...) the first vulnerability database download is very slow; the audit job allows 30 minutes.
+image: maven:3-eclipse-temurin-21
+
+stages:
+  - check
+
+default:
+  timeout: 30 minutes
+
+lint:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'mvn -B checkstyle:check -Dcheckstyle.config.location=google_checks.xml -Dcheckstyle.violationSeverity=warning 2>&1 | tee -a reports/lint.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+      - target/surefire-reports/
+      - target/dependency-check-report.html
+
+test:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'mvn -B test 2>&1 | tee -a reports/test.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+      - target/surefire-reports/
+      - target/dependency-check-report.html
+
+build:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'mvn -B -DskipTests package 2>&1 | tee -a reports/build.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+      - target/surefire-reports/
+      - target/dependency-check-report.html
+
+audit:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'mvn -B org.owasp:dependency-check-maven:12.1.0:check -DfailBuildOnCVSS=7 2>&1 | tee -a reports/audit.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+      - target/surefire-reports/
+      - target/dependency-check-report.html

package/dist/method/skills/setup-ci/assets/stack-python-github.yml

@@ -0,0 +1,123 @@
+# Base CI for Python (pytest, ruff, pip-audit): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the pull request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: lint
+        run: |
+          mkdir -p reports
+          pip install ruff 2>&1 | tee -a reports/lint.txt
+          ruff check . 2>&1 | tee -a reports/lint.txt
+          ruff format --check . 2>&1 | tee -a reports/lint.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: lint-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: test
+        run: |
+          mkdir -p reports
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; else pip install -e .; fi
+          pip install pytest 2>&1 | tee -a reports/test.txt
+          pytest --junitxml=reports/junit.xml 2>&1 | tee -a reports/test.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  build:
+    name: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: build
+        run: |
+          mkdir -p reports
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; else pip install -e .; fi
+          pip install build 2>&1 | tee -a reports/build.txt
+          python -m build 2>&1 | tee -a reports/build.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14
+
+  audit:
+    name: audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: audit
+        run: |
+          mkdir -p reports
+          if [ -f requirements.txt ]; then pip install -r requirements.txt; else pip install -e .; fi
+          pip install pip-audit 2>&1 | tee -a reports/audit.txt
+          pip-audit 2>&1 | tee -a reports/audit.txt
+      - name: Keep the evidence
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: audit-evidence
+          path: |
+            reports/
+          if-no-files-found: ignore
+          retention-days: 14

package/dist/method/skills/setup-ci/assets/stack-python-gitlab.yml

@@ -0,0 +1,68 @@
+# Base CI for Python (pytest, ruff, pip-audit): a template of the method, advice only.
+# Yours to edit or to leave: decline it and nothing else changes. It makes no call to the method;
+# every tool below is the ecosystem's own and free.
+# One job per check of the merge request (lint, test, build, audit). A failed job keeps its logs and
+# reports in `reports/` as a CI artifact. Adjust versions and paths to your product.
+image: python:3.12
+
+stages:
+  - check
+
+default:
+  timeout: 30 minutes
+
+lint:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'pip install ruff 2>&1 | tee -a reports/lint.txt'
+    - 'ruff check . 2>&1 | tee -a reports/lint.txt'
+    - 'ruff format --check . 2>&1 | tee -a reports/lint.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+test:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'if [ -f requirements.txt ]; then pip install -r requirements.txt; else pip install -e .; fi'
+    - 'pip install pytest 2>&1 | tee -a reports/test.txt'
+    - 'pytest --junitxml=reports/junit.xml 2>&1 | tee -a reports/test.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+build:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'if [ -f requirements.txt ]; then pip install -r requirements.txt; else pip install -e .; fi'
+    - 'pip install build 2>&1 | tee -a reports/build.txt'
+    - 'python -m build 2>&1 | tee -a reports/build.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/
+
+audit:
+  stage: check
+  script:
+    - set -o pipefail
+    - mkdir -p reports
+    - 'if [ -f requirements.txt ]; then pip install -r requirements.txt; else pip install -e .; fi'
+    - 'pip install pip-audit 2>&1 | tee -a reports/audit.txt'
+    - 'pip-audit 2>&1 | tee -a reports/audit.txt'
+  artifacts:
+    when: on_failure
+    expire_in: 2 weeks
+    paths:
+      - reports/