blockmine 1.21.0 → 1.23.0

package/.claude/skills/build-engineering/resources/dependency-management.md

@@ -0,0 +1,73 @@
+# Dependency Management
+
+Guide to dependency management including version pinning, lock files, conflict resolution, and vulnerability scanning.
+
+## Overview
+
+Proper dependency management ensures reproducible builds, security, and maintainability.
+
+## Version Pinning
+
+### npm/yarn
+```json
+{
+  "dependencies": {
+    "express": "4.18.2"
+  }
+}
+```
+
+### Maven
+```xml
+<dependency>
+    <groupId>org.springframework.boot</groupId>
+    <artifactId>spring-boot-starter-web</artifactId>
+    <version>3.1.0</version>
+</dependency>
+```
+
+### Gradle
+```kotlin
+dependencies {
+    implementation("com.google.guava:guava:31.1-jre")
+}
+```
+
+## Lock Files
+
+### package-lock.json
+Ensures exact dependency versions across environments.
+
+### Gemfile.lock (Ruby)
+Locks Ruby gem versions.
+
+### go.sum (Go)
+Cryptographic checksums of dependencies.
+
+## Vulnerability Scanning
+
+```bash
+# npm audit
+npm audit
+npm audit fix
+
+# Snyk
+snyk test
+snyk monitor
+
+# OWASP Dependency Check
+dependency-check --project myapp --scan ./
+```
+
+## Best Practices
+
+1. **Use lock files** - Commit to version control
+2. **Pin versions** - Avoid floating versions in production
+3. **Regular updates** - Keep dependencies current
+4. **Scan for vulnerabilities** - Automated scanning
+5. **Review licenses** - Ensure compliance
+6. **Minimize dependencies** - Less is more
+7. **Use private registries** - For internal packages
+8. **Audit regularly** - Monthly dependency reviews
+9. **Document dependencies** - Why each is needed
+10. **Test updates** - Before merging

package/.claude/skills/build-engineering/resources/monorepo-builds.md

@@ -0,0 +1,110 @@
+# Monorepo Builds
+
+Guide to monorepo build strategies including affected detection, Nx, Turborepo, and Bazel.
+
+## Overview
+
+Monorepos house multiple projects in single repository, requiring sophisticated build strategies.
+
+## Affected Detection
+
+### Nx
+```json
+{
+  "affected": {
+    "defaultBase": "main"
+  }
+}
+```
+
+```bash
+# Build only affected projects
+nx affected:build
+
+# Test affected
+nx affected:test
+
+# Lint affected
+nx affected:lint
+```
+
+### Turborepo
+```json
+{
+  "$schema": "https://turbo.build/schema.json",
+  "pipeline": {
+    "build": {
+      "dependsOn": ["^build"],
+      "outputs": ["dist/**"]
+    },
+    "test": {
+      "dependsOn": ["build"],
+      "outputs": []
+    }
+  }
+}
+```
+
+```bash
+# Build with caching
+turbo run build
+
+# Build only changed
+turbo run build --filter="...[HEAD^]"
+```
+
+## Workspace Management
+
+### npm Workspaces
+```json
+{
+  "name": "monorepo",
+  "workspaces": [
+    "packages/*",
+    "apps/*"
+  ]
+}
+```
+
+### pnpm Workspaces
+```yaml
+packages:
+  - 'packages/*'
+  - 'apps/*'
+  - '!**/test/**'
+```
+
+### Yarn Workspaces
+```json
+{
+  "private": true,
+  "workspaces": {
+    "packages": ["packages/*"],
+    "nohoist": ["**/react-native", "**/react-native/**"]
+  }
+}
+```
+
+## Dependency Graph
+
+### Visualize
+```bash
+# Nx dependency graph
+nx graph
+
+# Show affected
+nx affected:graph
+```
+
+## Best Practices
+
+1. **Use affected builds** - Only build changed projects
+2. **Shared dependencies** - Hoist common packages
+3. **Consistent tooling** - Same versions across projects
+4. **Dependency graph** - Understand project relationships
+5. **Incremental builds** - Cache across projects
+6. **Parallel execution** - Build independent projects
+7. **Versioning strategy** - Sync or independent
+8. **Clear ownership** - CODEOWNERS for each project
+9. **Documentation** - Project relationships
+10. **Testing strategy** - Unit + integration

package/.claude/skills/build-engineering/resources/performance-optimization.md

@@ -0,0 +1,113 @@
+# Performance Optimization
+
+Guide to build performance optimization including profiling, parallelization, and bottleneck analysis.
+
+## Overview
+
+Optimizing build performance improves developer productivity and reduces costs.
+
+## Build Profiling
+
+### Gradle
+```bash
+# Profile build
+./gradlew build --profile
+
+# Scan build
+./gradlew build --scan
+```
+
+### Maven
+```bash
+# Profile
+mvn clean install -Dprofile
+
+# Debug
+mvn clean install -X
+```
+
+### npm
+```bash
+# Time tasks
+npm run build --timing
+
+# Verbose
+npm run build --verbose
+```
+
+## Bottleneck Analysis
+
+### Identify Slow Tasks
+```bash
+# Gradle task breakdown
+./gradlew build --profile
+
+# Check time in report
+cat build/reports/profile/*.html
+```
+
+### Dependency Resolution
+```bash
+# Gradle dependency insight
+./gradlew dependencies --configuration compileClasspath
+
+# Maven dependency tree
+mvn dependency:tree
+```
+
+## Optimization Strategies
+
+### Parallel Execution
+```kotlin
+// gradle.properties
+org.gradle.parallel=true
+org.gradle.workers.max=8
+```
+
+### Incremental Builds
+```kotlin
+tasks.withType<JavaCompile> {
+    options.isIncremental = true
+}
+```
+
+### Skip Unnecessary Tasks
+```bash
+# Skip tests
+./gradlew build -x test
+
+# Skip specific tasks
+npm run build --ignore-scripts
+```
+
+## Metrics
+
+### Track Build Times
+```yaml
+# GitHub Actions
+- name: Build
+  run: |
+    start=$SECONDS
+    npm run build
+    duration=$(( SECONDS - start ))
+    echo "Build time: $duration seconds"
+```
+
+### Monitor Trends
+- Average build time
+- P95/P99 build times
+- Cache hit rates
+- Dependency resolution time
+
+## Best Practices
+
+1. **Profile regularly** - Weekly build profiles
+2. **Enable caching** - Local and remote
+3. **Parallelize** - Independent tasks
+4. **Incremental builds** - Only rebuild changed
+5. **Optimize dependencies** - Remove unused
+6. **Monitor metrics** - Track over time
+7. **Use build scans** - Gradle/Maven scans
+8. **Upgrade tools** - Latest build tool versions
+9. **Review regularly** - Monthly optimization review
+10. **Document findings** - Share learnings

package/.claude/skills/build-engineering/resources/reproducible-builds.md

@@ -0,0 +1,82 @@
+# Reproducible Builds
+
+Guide to deterministic and hermetic builds using SLSA framework principles.
+
+## Overview
+
+Reproducible builds ensure identical outputs from identical inputs, critical for security and debugging.
+
+## Deterministic Builds
+
+### Remove Timestamps
+```dockerfile
+# Bad - includes timestamp
+FROM node:18
+RUN date > build-time.txt
+COPY . .
+RUN npm run build
+
+# Good - reproducible
+FROM node:18
+COPY package*.json ./
+RUN npm ci
+COPY . .
+RUN npm run build
+```
+
+### Sort File Lists
+```makefile
+FILES := $(sort $(wildcard src/*.c))
+```
+
+## Hermetic Builds
+
+### Bazel
+```python
+# BUILD file
+java_binary(
+    name = "app",
+    srcs = ["Main.java"],
+    deps = ["@maven//:com_google_guava_guava"],
+)
+```
+
+### Docker
+```dockerfile
+# Pin base image
+FROM node:18.17.0-alpine3.18
+
+# Pin package versions
+RUN npm ci --production
+```
+
+## SLSA Framework
+
+### Level 1: Documented
+- Build process documented
+- Provenance exists
+
+### Level 2: Hosted
+- Version control
+- Hosted build service
+
+### Level 3: Hardened
+- Hardened build platform
+- Provenance verification
+
+### Level 4: Two-party review
+- Code review required
+- Multiple approvers
+
+## Best Practices
+
+1. **Pin all versions** - Tools and dependencies
+2. **Avoid timestamps** - Use git commit hash
+3. **Use hermetic builds** - Isolated build environment
+4. **Document environment** - OS, tool versions
+5. **Verify reproducibility** - Regular verification
+6. **Generate provenance** - Build metadata
+7. **Sign artifacts** - Cryptographic signatures
+8. **Audit build process** - Security reviews
+9. **Use containers** - Consistent environment
+10. **Test reproducibility** - Automated verification