aigroup-workflow 2.1.1 → 2.2.0

package/skills/devops-engineer/references/release-automation.md

@@ -1,527 +0,0 @@
-# Release Automation
-
-## Artifact Management
-
-### Container Registry Lifecycle
-
-```json
-{
-  "rules": [
-    {
-      "rulePriority": 1,
-      "description": "Keep last 10 prod images",
-      "selection": {
-        "tagStatus": "tagged",
-        "tagPrefixList": ["prod-"],
-        "countType": "imageCountMoreThan",
-        "countNumber": 10
-      },
-      "action": {"type": "expire"}
-    },
-    {
-      "rulePriority": 2,
-      "description": "Remove untagged after 7 days",
-      "selection": {
-        "tagStatus": "untagged",
-        "countType": "sinceImagePushed",
-        "countUnit": "days",
-        "countNumber": 7
-      },
-      "action": {"type": "expire"}
-    }
-  ]
-}
-```
-
-### Artifact Promotion
-
-```yaml
-# .github/workflows/promote.yml
-name: Artifact Promotion
-
-on:
-  workflow_dispatch:
-    inputs:
-      image_tag:
-        required: true
-      target_env:
-        type: choice
-        options: [staging, production]
-
-jobs:
-  promote:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Re-tag for environment
-        run: |
-          docker pull $REGISTRY/$IMAGE:${{ inputs.image_tag }}
-          docker tag $REGISTRY/$IMAGE:${{ inputs.image_tag }} \
-            $REGISTRY/$IMAGE:${{ inputs.target_env }}-latest
-          docker push $REGISTRY/$IMAGE:${{ inputs.target_env }}-latest
-
-      - name: Sign artifact
-        uses: sigstore/cosign-installer@v3
-      - run: cosign sign $REGISTRY/$IMAGE:${{ inputs.target_env }}-latest
-
-      - name: Update GitOps
-        run: |
-          cd gitops/apps/${{ inputs.target_env }}
-          yq e '.image.tag = "${{ inputs.image_tag }}"' -i values.yaml
-          git commit -am "Promote to ${{ inputs.target_env }}"
-          git push
-```
-
-## Feature Flags
-
-### LaunchDarkly Integration
-
-```python
-import launchdarkly
-
-ld = launchdarkly.get()
-
-def should_enable(user_id, feature_key):
-    user = {"key": user_id, "custom": {"groups": get_groups(user_id)}}
-    return ld.variation(feature_key, user, False)
-
-# Usage
-if should_enable(user.id, "new-payment-flow"):
-    return new_payment_service.process(payment)
-else:
-    return legacy_payment_service.process(payment)
-```
-
-### Flagger Progressive Delivery
-
-```yaml
-apiVersion: flagger.app/v1beta1
-kind: Canary
-metadata:
-  name: payment-service
-spec:
-  targetRef:
-    kind: Deployment
-    name: payment-service
-  service:
-    port: 8080
-  analysis:
-    interval: 1m
-    threshold: 5
-    maxWeight: 50
-    stepWeight: 10
-    metrics:
-      - name: request-success-rate
-        thresholdRange:
-          min: 99
-      - name: request-duration
-        thresholdRange:
-          max: 500
-    webhooks:
-      - name: load-test
-        url: http://flagger-loadtester/
-        metadata:
-          cmd: "hey -z 1m -q 10 http://payment-canary/"
-```
-
-## Multi-Platform CI/CD
-
-### GitLab CI
-
-```yaml
-stages: [test, build, deploy]
-
-test:
-  stage: test
-  image: node:20
-  script:
-    - npm ci && npm test
-
-build:
-  stage: build
-  image: docker:latest
-  services: [docker:dind]
-  script:
-    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
-    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
-
-deploy:production:
-  stage: deploy
-  script:
-    - kubectl set image deployment/app app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
-  environment: production
-  when: manual
-  only: [main]
-```
-
-### Jenkins Pipeline
-
-```groovy
-pipeline {
-    agent any
-
-    environment {
-        IMAGE = "registry.example.com/app"
-    }
-
-    stages {
-        stage('Test') {
-            steps {
-                sh 'npm ci && npm test'
-                junit 'reports/junit.xml'
-            }
-        }
-
-        stage('Build') {
-            steps {
-                script {
-                    docker.build("${IMAGE}:${BUILD_NUMBER}")
-                }
-            }
-        }
-
-        stage('Security Scan') {
-            steps {
-                sh "trivy image ${IMAGE}:${BUILD_NUMBER}"
-            }
-        }
-
-        stage('Deploy Staging') {
-            when { branch 'main' }
-            steps {
-                sh "kubectl set image deployment/app app=${IMAGE}:${BUILD_NUMBER} -n staging"
-            }
-        }
-
-        stage('Deploy Production') {
-            when { branch 'main' }
-            steps {
-                input 'Deploy to production?'
-                sh "kubectl set image deployment/app app=${IMAGE}:${BUILD_NUMBER} -n production"
-            }
-        }
-    }
-
-    post {
-        failure {
-            slackSend color: 'danger', message: "Build failed: ${JOB_NAME}"
-        }
-    }
-}
-```
-
-## Build Optimization
-
-### Multi-stage Docker Build
-
-```dockerfile
-FROM node:20 AS deps
-WORKDIR /app
-COPY package*.json ./
-RUN npm ci --only=production
-
-FROM node:20 AS builder
-WORKDIR /app
-COPY package*.json ./
-RUN npm ci
-COPY . .
-RUN npm run build
-
-FROM node:20-slim AS runner
-WORKDIR /app
-ENV NODE_ENV production
-COPY --from=deps /app/node_modules ./node_modules
-COPY --from=builder /app/dist ./dist
-USER node
-CMD ["node", "dist/main.js"]
-```
-
-### Parallel Testing
-
-```yaml
-# CircleCI
-version: 2.1
-jobs:
-  test:
-    parallelism: 4
-    docker:
-      - image: cimg/node:20
-    steps:
-      - checkout
-      - run: npm ci
-      - run: |
-          TESTS=$(circleci tests glob "test/**/*.js" | circleci tests split)
-          npm test $TESTS
-```
-
-## Release Orchestration
-
-```bash
-#!/bin/bash
-# release.sh - Multi-service coordinated release
-
-VERSION=$1
-SERVICES=(auth api worker frontend)
-
-echo "Release: $VERSION"
-
-# Create release branches
-for svc in "${SERVICES[@]}"; do
-    gh api repos/org/$svc/git/refs -f ref=refs/heads/release/$VERSION -f sha=$(git rev-parse main)
-done
-
-# Trigger builds
-for svc in "${SERVICES[@]}"; do
-    gh workflow run ci.yml --repo org/$svc --ref release/$VERSION
-done
-
-# Wait for completion
-for svc in "${SERVICES[@]}"; do
-    gh run watch --repo org/$svc $(gh run list --repo org/$svc -L1 -q '.[0].databaseId')
-done
-
-# Deploy to staging
-kubectl apply -f staging/release-$VERSION.yaml
-
-# Smoke tests
-./scripts/smoke-test.sh staging
-
-echo "✓ Release $VERSION ready for production"
-```
-
-## Dependency Management
-
-### Renovate Auto-Update
-
-```json
-{
-  "extends": ["config:base"],
-  "packageRules": [
-    {
-      "matchUpdateTypes": ["minor", "patch"],
-      "automerge": true
-    },
-    {
-      "matchDepTypes": ["devDependencies"],
-      "automerge": true
-    }
-  ],
-  "schedule": ["before 6am on Monday"],
-  "prConcurrentLimit": 5
-}
-```
-
-## Build Optimization
-
-### Build Caching Strategy
-
-```yaml
-# GitHub Actions: Multi-layer caching
-- name: Cache dependencies
-  uses: actions/cache@v3
-  with:
-    path: |
-      ~/.npm
-      ~/.cache
-      node_modules
-    key: ${{ runner.os }}-deps-${{ hashFiles('**/package-lock.json') }}
-    restore-keys: |
-      ${{ runner.os }}-deps-
-
-- name: Cache Docker layers
-  uses: docker/build-push-action@v4
-  with:
-    context: .
-    cache-from: type=gha
-    cache-to: type=gha,mode=max
-```
-
-### Parallel CI Pipeline
-
-```yaml
-# Multi-platform builds in parallel
-name: Build
-
-on: [push]
-
-jobs:
-  test:
-    strategy:
-      matrix:
-        node: [18, 20, 22]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          node-version: ${{ matrix.node }}
-      - run: npm ci && npm test
-
-  build-images:
-    needs: test
-    strategy:
-      matrix:
-        platform: [linux/amd64, linux/arm64]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: docker/build-push-action@v4
-        with:
-          platforms: ${{ matrix.platform }}
-          tags: app:${{ github.sha }}
-```
-
-## Multi-Service Release Orchestration
-
-```yaml
-# release-coordinator.yaml
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: release-v2.5.0
-spec:
-  template:
-    spec:
-      containers:
-        - name: coordinator
-          image: release-bot:latest
-          env:
-            - name: RELEASE_VERSION
-              value: "v2.5.0"
-            - name: SERVICES
-              value: "auth,api,worker,frontend"
-          command:
-            - /bin/bash
-            - -c
-            - |
-              # Deploy in dependency order
-              for svc in auth api worker frontend; do
-                echo "Deploying $svc..."
-                kubectl set image deploy/$svc \
-                  $svc=registry.io/$svc:$RELEASE_VERSION
-
-                kubectl rollout status deploy/$svc --timeout=5m
-
-                # Health check
-                kubectl run test-$svc --rm -i --restart=Never \
-                  --image=curlimages/curl -- \
-                  curl -f http://$svc/health
-
-                echo "$svc deployed successfully"
-              done
-```
-
-## Advanced Artifact Management
-
-```bash
-#!/bin/bash
-# artifact-scanner.sh - Scan before promotion
-
-IMAGE=$1
-SEVERITY=${2:-HIGH}
-
-# Vulnerability scan
-trivy image --severity $SEVERITY --exit-code 1 $IMAGE
-
-# License compliance
-syft $IMAGE -o json | \
-  jq '.artifacts[].licenses[] | select(.value |
-    contains("GPL") or contains("AGPL"))' && \
-  echo "License violation detected" && exit 1
-
-# SBOM generation
-syft $IMAGE -o spdx-json > sbom-$(basename $IMAGE).spdx.json
-
-# Sign artifact
-cosign sign --key cosign.key $IMAGE
-
-# Promote
-docker tag $IMAGE $IMAGE-approved
-docker push $IMAGE-approved
-
-echo "Artifact $IMAGE approved and promoted"
-```
-
-## Zero-Downtime Database Migrations
-
-```python
-# migrations/release_v2.5.py
-from alembic import op
-import sqlalchemy as sa
-
-def upgrade():
-    # Step 1: Add new column (nullable)
-    op.add_column('users',
-      sa.Column('email_verified', sa.Boolean(), nullable=True))
-
-    # Step 2: Backfill data (in batches)
-    connection = op.get_bind()
-    connection.execute("""
-      UPDATE users SET email_verified = true
-      WHERE email IS NOT NULL
-      LIMIT 1000
-    """)
-    # Repeat until complete (or use background job)
-
-    # Step 3: Make non-nullable (in next release)
-    # op.alter_column('users', 'email_verified', nullable=False)
-
-def downgrade():
-    op.drop_column('users', 'email_verified')
-```
-
-## Release Metrics Dashboard
-
-```yaml
-# Grafana dashboard for release metrics
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: release-dashboard
-data:
-  dashboard.json: |
-    {
-      "panels": [
-        {
-          "title": "Deployment Frequency",
-          "targets": [{
-            "expr": "count_over_time(deployment_completed[1d])"
-          }]
-        },
-        {
-          "title": "Lead Time",
-          "targets": [{
-            "expr": "histogram_quantile(0.95, commit_to_deploy_seconds_bucket)"
-          }]
-        },
-        {
-          "title": "Change Failure Rate",
-          "targets": [{
-            "expr": "sum(rate(deployment_failed[1h])) / sum(rate(deployment_total[1h]))"
-          }]
-        },
-        {
-          "title": "Active Releases",
-          "targets": [{
-            "expr": "count(release_in_progress == 1)"
-          }]
-        }
-      ]
-    }
-```
-
-## Best Practices
-
-- Version artifacts with immutable tags
-- Implement retention policies
-- Use progressive delivery for high-risk changes
-- Automate security scanning
-- Maintain deployment audit trails
-- Enable easy rollbacks
-- Monitor deployment metrics
-- Use feature flags for flexibility
-- Cache aggressively for fast builds
-- Parallelize test and build jobs
-- Coordinate multi-service releases
-- Generate and track SBOMs
-- Sign artifacts for supply chain security
-- Automate dependency updates
-- Track DORA metrics continuously

package/skills/devops-engineer/references/terraform-iac.md

@@ -1,141 +0,0 @@
-# Terraform Infrastructure as Code
-
-## AWS ECS Fargate Setup
-
-```hcl
-terraform {
-  required_providers {
-    aws = { source = "hashicorp/aws", version = "~> 5.0" }
-  }
-  backend "s3" {
-    bucket = "terraform-state"
-    key    = "app/terraform.tfstate"
-    region = "us-east-1"
-  }
-}
-
-resource "aws_ecs_cluster" "main" {
-  name = "app-cluster"
-  setting {
-    name  = "containerInsights"
-    value = "enabled"
-  }
-}
-
-resource "aws_ecs_task_definition" "app" {
-  family                   = "app"
-  network_mode             = "awsvpc"
-  requires_compatibilities = ["FARGATE"]
-  cpu                      = "256"
-  memory                   = "512"
-  execution_role_arn       = aws_iam_role.ecs_execution.arn
-
-  container_definitions = jsonencode([{
-    name  = "app"
-    image = "${var.ecr_repository}:${var.image_tag}"
-    portMappings = [{ containerPort = 3000 }]
-    logConfiguration = {
-      logDriver = "awslogs"
-      options = {
-        awslogs-group         = aws_cloudwatch_log_group.app.name
-        awslogs-region        = var.region
-        awslogs-stream-prefix = "app"
-      }
-    }
-    secrets = [
-      { name = "DATABASE_URL", valueFrom = aws_ssm_parameter.db_url.arn }
-    ]
-  }])
-}
-
-resource "aws_ecs_service" "app" {
-  name            = "app"
-  cluster         = aws_ecs_cluster.main.id
-  task_definition = aws_ecs_task_definition.app.arn
-  desired_count   = 2
-  launch_type     = "FARGATE"
-
-  network_configuration {
-    subnets         = var.private_subnets
-    security_groups = [aws_security_group.app.id]
-  }
-
-  load_balancer {
-    target_group_arn = aws_lb_target_group.app.arn
-    container_name   = "app"
-    container_port   = 3000
-  }
-}
-```
-
-## AWS RDS PostgreSQL
-
-```hcl
-resource "aws_db_instance" "postgres" {
-  identifier           = "app-db"
-  engine               = "postgres"
-  engine_version       = "16.1"
-  instance_class       = "db.t3.micro"
-  allocated_storage    = 20
-  storage_encrypted    = true
-
-  db_name              = "app"
-  username             = "admin"
-  password             = var.db_password
-
-  vpc_security_group_ids = [aws_security_group.db.id]
-  db_subnet_group_name   = aws_db_subnet_group.main.name
-
-  backup_retention_period = 7
-  skip_final_snapshot     = false
-  final_snapshot_identifier = "app-db-final"
-
-  tags = { Environment = var.environment }
-}
-```
-
-## Variables and Outputs
-
-```hcl
-# variables.tf
-variable "environment" {
-  type        = string
-  description = "Environment name"
-}
-
-variable "region" {
-  type    = string
-  default = "us-east-1"
-}
-
-# outputs.tf
-output "ecs_cluster_arn" {
-  value = aws_ecs_cluster.main.arn
-}
-
-output "alb_dns_name" {
-  value = aws_lb.main.dns_name
-}
-```
-
-## Best Practices
-
-| Practice | Implementation |
-|----------|----------------|
-| State locking | S3 backend with DynamoDB |
-| Secrets | Use AWS Secrets Manager / SSM |
-| Modules | Reusable components |
-| Workspaces | Environment separation |
-| Tagging | Consistent resource tags |
-| Validation | `terraform validate`, `tflint` |
-
-## Common Commands
-
-```bash
-terraform init
-terraform plan -out=tfplan
-terraform apply tfplan
-terraform destroy
-terraform state list
-terraform import aws_instance.app i-1234567890
-```