aidevops 2.52.1

package/.agent/aidevops/resources.md

@@ -0,0 +1,214 @@
+---
+description: External resources and documentation links
+mode: subagent
+tools:
+  read: true
+  write: false
+  edit: false
+  bash: false
+  glob: true
+  grep: true
+  webfetch: true
+---
+
+# External Resources & Links
+
+<!-- AI-CONTEXT-START -->
+
+## Quick Reference
+
+- **Hosting APIs**: Hostinger, Hetzner, Closte, Cloudron, Coolify
+- **Quality APIs**: CodeRabbit, CodeFactor, Codacy, SonarCloud
+- **Git APIs**: GitHub REST/GraphQL, GitLab v4, Gitea
+- **DNS APIs**: Cloudflare, Namecheap, Route 53
+- **MCP Protocol**: https://spec.modelcontextprotocol.io/
+- **AGENTS.md Standard**: https://agents.md/
+- **CLI Tools**: jq, curl, git, Bitwarden CLI
+- **DevOps**: Terraform, Ansible, Docker, Kubernetes
+- **CI/CD**: GitHub Actions, GitLab CI/CD
+- **Config templates**: `configs/[service]-config.json.txt`
+<!-- AI-CONTEXT-END -->
+
+## Service Documentation & APIs
+
+### Infrastructure & Hosting
+
+- **Hostinger API**: https://developers.hostinger.com/
+- **Hetzner Cloud API**: https://docs.hetzner.cloud/
+- **Closte API**: https://closte.com/api-documentation
+- **Cloudron API**: https://docs.cloudron.io/api/
+
+### Deployment & Orchestration
+
+- **Coolify API**: https://coolify.io/.agent/api
+- **Coolify GitHub**: https://github.com/coollabsio/coolify
+
+### Content Management
+
+- **MainWP API**: https://mainwp.com/help/.agent/mainwp-rest-api/
+- **MainWP Extensions**: https://mainwp.com/extensions/
+
+### Security & Secrets
+
+- **Vaultwarden**: https://github.com/dani-garcia/vaultwarden
+- **Bitwarden API**: https://bitwarden.com/help/api/
+- **Bitwarden CLI**: https://bitwarden.com/help/cli/
+
+### Code Quality & Auditing
+
+- **CodeRabbit API**: https://docs.coderabbit.ai/
+- **CodeFactor API**: https://docs.codefactor.io/
+- **Codacy API**: https://docs.codacy.com/codacy-api/
+- **SonarCloud API**: https://docs.sonarsource.com/sonarqube-cloud/
+
+### Version Control & Git Platforms
+
+- **GitHub API**: https://docs.github.com/en/rest
+- **GitLab API**: https://docs.gitlab.com/ee/api/
+- **Gitea API**: https://docs.gitea.io/en-us/api-usage/
+
+### Email Services
+
+- **Amazon SES API**: https://docs.aws.amazon.com/ses/
+- **SES Developer Guide**: https://docs.aws.amazon.com/ses/latest/dg/
+
+### Domain & DNS
+
+- **Spaceship API**: https://spaceship.com/api
+- **101domains API**: https://101domain.com/api
+- **Cloudflare API**: https://developers.cloudflare.com/api/
+- **Namecheap API**: https://www.namecheap.com/support/api/
+- **Route 53 API**: https://docs.aws.amazon.com/route53/
+
+## MCP Server Resources
+
+### Official MCP Servers
+
+- **Context7 MCP**: https://github.com/context7/mcp-server
+- **Bitwarden MCP**: https://github.com/bitwarden/mcp-server
+- **GitHub MCP**: https://github.com/github/mcp-server
+
+### Community MCP Servers
+
+- **Codacy MCP**: https://github.com/codacy/codacy-mcp-server
+- **SonarQube MCP**: https://github.com/SonarSource/sonarqube-mcp-server
+- **GitLab MCP**: https://gitlab.com/gitlab-org/mcp-server
+
+### MCP Protocol Documentation
+
+- **MCP Specification**: https://spec.modelcontextprotocol.io/
+- **MCP SDK**: https://github.com/modelcontextprotocol/sdk
+- **MCP Examples**: https://github.com/modelcontextprotocol/examples
+
+## Development Tools & Resources
+
+### CLI Tools
+
+- **jq (JSON processor)**: https://jqlang.github.io/jq/
+- **curl (HTTP client)**: https://curl.se/.agent/
+- **git (Version control)**: https://git-scm.com/docs
+- **Bitwarden CLI**: https://bitwarden.com/help/cli/
+
+### Package Managers
+
+- **Homebrew (macOS)**: https://brew.sh/
+- **APT (Ubuntu/Debian)**: https://ubuntu.com/server/.agent/package-management
+- **npm (Node.js)**: https://docs.npmjs.com/
+
+### Security Tools
+
+- **OpenSSL**: https://www.openssl.org/.agent/
+- **GPG**: https://gnupg.org/documentation/
+- **SSH**: https://www.openssh.com/manual.html
+
+## Standards & Specifications
+
+### AI Agent Standards
+
+- **AGENTS.md Standard**: https://agents.md/
+- **Agent Directory Proposal**: https://github.com/agents-md/agents.md
+- **MCP Protocol**: https://spec.modelcontextprotocol.io/
+
+### API Standards
+
+- **REST API Design**: https://restfulapi.net/
+- **OpenAPI Specification**: https://swagger.io/specification/
+- **JSON Schema**: https://json-schema.org/
+
+### Security Standards
+
+- **OWASP API Security**: https://owasp.org/www-project-api-security/
+- **OAuth 2.0**: https://oauth.net/2/
+- **JWT**: https://jwt.io/
+
+## Monitoring & Observability
+
+### Monitoring Tools
+
+- **Prometheus**: https://prometheus.io/.agent/
+- **Grafana**: https://grafana.com/.agent/
+- **Uptime Robot**: https://uptimerobot.com/api/
+
+### Log Management
+
+- **ELK Stack**: https://www.elastic.co/elastic-stack/
+- **Fluentd**: https://docs.fluentd.org/
+- **Logrotate**: https://linux.die.net/man/8/logrotate
+
+## DevOps Resources
+
+### Infrastructure as Code
+
+- **Terraform**: https://developer.hashicorp.com/terraform/docs
+- **Ansible**: https://docs.ansible.com/
+- **Docker**: https://docs.docker.com/
+
+### CI/CD Platforms
+
+- **GitHub Actions**: https://docs.github.com/en/actions
+- **GitLab CI/CD**: https://docs.gitlab.com/ee/ci/
+- **Jenkins**: https://www.jenkins.io/doc/
+
+### Container Orchestration
+
+- **Kubernetes**: https://kubernetes.io/.agent/
+- **Docker Compose**: https://docs.docker.com/compose/
+- **Portainer**: https://docs.portainer.io/
+
+## Learning Resources
+
+### DevOps Learning
+
+- **DevOps Roadmap**: https://roadmap.sh/devops
+- **AWS Training**: https://aws.amazon.com/training/
+- **Google Cloud Training**: https://cloud.google.com/training
+
+### API Development
+
+- **Postman Learning**: https://learning.postman.com/
+- **REST API Tutorial**: https://restapitutorial.com/
+- **GraphQL Learning**: https://graphql.org/learn/
+
+### Security Learning
+
+- **OWASP Learning**: https://owasp.org/www-project-top-ten/
+- **Security Headers**: https://securityheaders.com/
+- **SSL Labs**: https://www.ssllabs.com/ssltest/
+
+## Configuration Examples
+
+### Service Configuration Templates
+
+- All configuration templates are in `../configs/` directory
+- Follow the pattern: `[service]-config.json.txt`
+- Use placeholder values like `YOUR_API_TOKEN_HERE`
+
+### Environment Setup
+
+- **macOS Setup**: Use Homebrew for package management
+- **Linux Setup**: Use distribution package manager
+- **Windows Setup**: Use WSL2 for best compatibility
+
+---
+
+**These resources provide comprehensive external documentation and tools needed to effectively use and extend the AI DevOps Framework.**

package/.agent/aidevops/security-requirements.md

@@ -0,0 +1,174 @@
+---
+description: Critical security compliance requirements
+mode: subagent
+tools:
+  read: true
+  write: false
+  edit: false
+  bash: false
+  glob: true
+  grep: true
+  webfetch: false
+---
+
+# Security Requirements - CRITICAL COMPLIANCE
+
+<!-- AI-CONTEXT-START -->
+
+## Quick Reference
+
+- **NEVER**: Hardcode API keys, commit credentials, include keys in commit messages
+- **ALWAYS**: Environment variables, GitHub Secrets for CI/CD, template placeholders
+- **Protected Files**: `configs/*-config.json`, `.env`, `*.key`, `*.pem`, `secrets/`
+- **Templates OK**: `configs/service-config.json.txt` with `YOUR_API_TOKEN_HERE` placeholders
+- **If Exposed**: Revoke immediately → Generate new → Update local + GitHub → Clean Git history
+- **Git Cleanup**: `git filter-branch` to remove from history, force push
+- **Rotation**: Every 90 days for Codacy, SonarCloud, GitHub tokens
+- **Audits**: Monthly key review, quarterly access review, annual policy review
+<!-- AI-CONTEXT-END -->
+
+## Zero Tolerance Security Policies
+
+### API Key Management (MANDATORY)
+
+#### ❌ Never Allowed:
+
+- Hardcoding API keys in source code
+- Committing credentials to repository
+- Storing secrets in configuration files tracked by Git
+- Sharing API keys in documentation or comments
+- **Including API keys in commit messages** (CRITICAL VIOLATION)
+- Exposing credentials in Git history or commit metadata
+
+#### **✅ REQUIRED PRACTICES:**
+
+**Local Development:**
+
+```bash
+# Store in environment variables
+export CODACY_API_TOKEN="your_token_here"
+export SONAR_TOKEN="your_token_here"
+export GITHUB_TOKEN="your_token_here"
+
+# Add to shell profile for persistence
+echo 'export CODACY_API_TOKEN="your_token_here"' >> ~/.bashrc
+```
+
+**GitHub Actions:**
+
+```yaml
+# Use GitHub Secrets
+env:
+  CODACY_API_TOKEN: ${{ secrets.CODACY_API_TOKEN }}
+  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+```
+
+**Configuration Files:**
+
+```json
+{
+  "api_token": "YOUR_API_TOKEN_HERE",  // Template placeholder
+  "api_token": "${CODACY_API_TOKEN}"   // Environment variable reference
+}
+```
+
+### **File Security Requirements**
+
+#### **Protected Files (.gitignore):**
+
+```text
+# Security - Never commit sensitive information
+configs/*-config.json
+.env
+.env.local
+*.key
+*.pem
+secrets/
+```
+
+#### **Template Files (Safe to commit):**
+
+```text
+configs/service-config.json.txt  // Template with placeholders
+configs/service-config.json      // Actual config (gitignored)
+```
+
+### **Security Incident Response**
+
+#### **If API Key is Exposed:**
+
+1. **IMMEDIATE**: Revoke the exposed key at provider
+2. **IMMEDIATE**: Generate new API key
+3. **IMMEDIATE**: Update local environment variables
+4. **IMMEDIATE**: Update GitHub Secrets
+5. **IMMEDIATE**: Remove key from Git history if committed
+6. **DOCUMENT**: Log incident and remediation steps
+
+#### **Git History Cleanup:**
+
+```bash
+# Remove sensitive file from history
+git filter-branch --force --index-filter \
+  'git rm --cached --ignore-unmatch path/to/sensitive/file' \
+  --prune-empty --tag-name-filter cat -- --all
+
+# Fix commit message with API key
+git reset --hard COMMIT_HASH
+git commit --amend -F secure-message.txt
+git cherry-pick SUBSEQUENT_COMMITS
+git push --force-with-lease origin main
+
+# Force push to rewrite history
+git push origin --force --all
+```
+
+### **Compliance Verification**
+
+#### **Pre-Commit Checks:**
+
+```bash
+# Scan for potential secrets
+grep -r "api_token.*:" . --include="*.sh" --include="*.json"
+grep -r "API_TOKEN.*=" . --include="*.sh" --include="*.yml"
+
+# Verify .gitignore coverage
+git status --ignored
+```
+
+#### **Regular Security Audits:**
+
+- Monthly review of all API keys and rotation
+- Quarterly access review for all service accounts
+- Annual security policy review and updates
+
+### **Provider-Specific Security**
+
+#### **Codacy:**
+
+- API tokens from: https://app.codacy.com/account/api-tokens
+- Scope: Repository analysis only
+- Rotation: Every 90 days
+
+#### **SonarCloud:**
+
+- Tokens from: https://sonarcloud.io/account/security
+- Scope: Project analysis only
+- Rotation: Every 90 days
+
+#### **GitHub:**
+
+- Personal Access Tokens with minimal required scopes
+- Fine-grained tokens preferred over classic tokens
+- Regular review of token usage and permissions
+
+## 🎯 **SECURITY COMPLIANCE CHECKLIST**
+
+- [ ] No API keys in source code
+- [ ] All sensitive configs in .gitignore
+- [ ] Environment variables configured locally
+- [ ] GitHub Secrets configured for CI/CD
+- [ ] Regular key rotation schedule established
+- [ ] Incident response procedures documented
+- [ ] Security audit schedule implemented
+
+**REMEMBER: Security is not optional - it's mandatory for professional development.**