claude-autopm 2.8.2 → 2.8.3

package/packages/plugin-devops/commands/ci-pipeline-create.md

@@ -0,0 +1,581 @@
+# ci:pipeline-create
+
+Create production-ready CI/CD pipelines for GitHub Actions, Azure DevOps, or GitLab CI with Context7-verified best practices.
+
+## Description
+
+Generates comprehensive CI/CD pipeline configurations following industry best practices:
+- Multi-stage pipeline architecture (build, test, deploy)
+- Security scanning and vulnerability detection
+- Artifact management and caching
+- Environment-specific deployments
+- Secret management and security
+- Monitoring and observability integration
+
+## Required Documentation Access
+
+**MANDATORY:** Before creating pipelines, query Context7 for best practices:
+
+**Documentation Queries:**
+- `mcp://context7/github/actions-best-practices` - GitHub Actions patterns
+- `mcp://context7/azure-devops/pipelines` - Azure Pipelines best practices
+- `mcp://context7/docker/ci-cd` - Container CI/CD patterns
+- `mcp://context7/kubernetes/ci-cd` - Kubernetes deployment strategies
+- `mcp://context7/security/ci-cd-security` - CI/CD security best practices
+
+**Why This is Required:**
+- Ensures pipelines follow platform-specific best practices
+- Applies latest security and performance patterns
+- Validates deployment strategies
+- Prevents common CI/CD anti-patterns
+
+## Usage
+
+```bash
+/ci:pipeline-create [options]
+```
+
+## Options
+
+- `--platform <github|azure|gitlab>` - CI/CD platform (default: github)
+- `--type <node|python|docker|k8s>` - Project type
+- `--environments <dev,staging,prod>` - Target environments
+- `--registry <dockerhub|gcr|acr|ecr>` - Container registry
+- `--output <path>` - Output directory for pipeline files
+- `--include-security` - Add security scanning stages
+- `--include-deploy` - Add deployment stages
+- `--matrix` - Generate matrix build for multiple versions
+
+## Examples
+
+### Create GitHub Actions Workflow for Node.js
+```bash
+/ci:pipeline-create --platform github --type node --environments dev,staging,prod
+```
+
+### Create Azure Pipeline with Security Scanning
+```bash
+/ci:pipeline-create --platform azure --type docker --include-security --registry acr
+```
+
+### Create Multi-Environment Kubernetes Pipeline
+```bash
+/ci:pipeline-create --platform github --type k8s --environments dev,prod --include-deploy
+```
+
+### Create Matrix Build Pipeline
+```bash
+/ci:pipeline-create --platform github --type node --matrix
+```
+
+## Pipeline Architectures
+
+### 1. GitHub Actions - Node.js Application
+
+**Pattern from Context7 (/actions/toolkit):**
+
+```yaml
+name: Node.js CI/CD Pipeline
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+env:
+  NODE_VERSION: '18.x'
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  # Stage 1: Code Quality
+  lint-and-test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [16.x, 18.x, 20.x]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run linter
+        run: npm run lint
+
+      - name: Run tests
+        run: npm test -- --coverage
+
+      - name: Upload coverage
+        uses: codecov/codecov-action@v3
+        with:
+          files: ./coverage/lcov.info
+          flags: node-${{ matrix.node-version }}
+
+  # Stage 2: Security Scanning
+  security-scan:
+    runs-on: ubuntu-latest
+    needs: lint-and-test
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Run npm audit
+        run: npm audit --audit-level=moderate
+
+      - name: Run Snyk security scan
+        uses: snyk/actions/node@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+      - name: Run CodeQL analysis
+        uses: github/codeql-action/analyze@v2
+
+  # Stage 3: Build Docker Image
+  build-image:
+    runs-on: ubuntu-latest
+    needs: [lint-and-test, security-scan]
+    if: github.event_name != 'pull_request'
+
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha,prefix={{branch}}-
+
+      - name: Build and push image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          build-args: |
+            NODE_VERSION=${{ env.NODE_VERSION }}
+            BUILD_DATE=${{ github.event.head_commit.timestamp }}
+            VCS_REF=${{ github.sha }}
+
+  # Stage 4: Deploy to Development
+  deploy-dev:
+    runs-on: ubuntu-latest
+    needs: build-image
+    if: github.ref == 'refs/heads/develop'
+    environment:
+      name: development
+      url: https://dev.example.com
+
+    steps:
+      - name: Deploy to Kubernetes
+        uses: azure/k8s-deploy@v4
+        with:
+          namespace: dev
+          manifests: |
+            k8s/deployment.yaml
+            k8s/service.yaml
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:develop
+          pull-images: false
+
+      - name: Run smoke tests
+        run: |
+          curl -f https://dev.example.com/health || exit 1
+
+  # Stage 5: Deploy to Production
+  deploy-prod:
+    runs-on: ubuntu-latest
+    needs: build-image
+    if: github.ref == 'refs/heads/main'
+    environment:
+      name: production
+      url: https://example.com
+
+    steps:
+      - name: Deploy to Kubernetes
+        uses: azure/k8s-deploy@v4
+        with:
+          namespace: prod
+          manifests: |
+            k8s/deployment.yaml
+            k8s/service.yaml
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
+          pull-images: false
+
+      - name: Run smoke tests
+        run: |
+          curl -f https://example.com/health || exit 1
+
+      - name: Notify deployment
+        uses: slackapi/slack-github-action@v1
+        with:
+          payload: |
+            {
+              "text": "Deployed ${{ github.repository }} to production",
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "✅ *Production Deployment Successful*\n*Repository:* ${{ github.repository }}\n*SHA:* ${{ github.sha }}\n*Author:* ${{ github.actor }}"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+```
+
+### 2. Azure DevOps - Docker Application
+
+**Pattern from Context7 (/microsoft/azure-pipelines):**
+
+```yaml
+# azure-pipelines.yml
+trigger:
+  branches:
+    include:
+      - main
+      - develop
+  paths:
+    exclude:
+      - docs/*
+      - README.md
+
+pr:
+  branches:
+    include:
+      - main
+
+variables:
+  - name: imageRepository
+    value: 'myapp'
+  - name: dockerfilePath
+    value: '$(Build.SourcesDirectory)/Dockerfile'
+  - name: tag
+    value: '$(Build.BuildId)'
+  - name: vmImageName
+    value: 'ubuntu-latest'
+
+stages:
+  # Stage 1: Build and Test
+  - stage: Build
+    displayName: Build and Test
+    jobs:
+      - job: BuildJob
+        displayName: Build Application
+        pool:
+          vmImage: $(vmImageName)
+
+        steps:
+          - task: Docker@2
+            displayName: Build Docker image
+            inputs:
+              command: build
+              dockerfile: $(dockerfilePath)
+              tags: |
+                $(tag)
+                latest
+              arguments: '--build-arg BUILD_DATE=$(Build.BuildNumber)'
+
+          - task: Docker@2
+            displayName: Run container security scan
+            inputs:
+              command: run
+              arguments: '--rm aquasec/trivy image --severity HIGH,CRITICAL $(imageRepository):$(tag)'
+
+          - script: |
+              docker run --rm $(imageRepository):$(tag) npm test
+            displayName: Run tests in container
+
+  # Stage 2: Security Scanning
+  - stage: SecurityScan
+    displayName: Security Scanning
+    dependsOn: Build
+    jobs:
+      - job: ScanJob
+        displayName: Security Analysis
+        pool:
+          vmImage: $(vmImageName)
+
+        steps:
+          - task: WhiteSource@21
+            displayName: WhiteSource security scan
+            inputs:
+              cwd: '$(System.DefaultWorkingDirectory)'
+
+          - task: SonarCloudPrepare@1
+            inputs:
+              SonarCloud: 'SonarCloud'
+              organization: 'myorg'
+              scannerMode: 'CLI'
+
+          - task: SonarCloudAnalyze@1
+
+          - task: SonarCloudPublish@1
+            inputs:
+              pollingTimeoutSec: '300'
+
+  # Stage 3: Push to Registry
+  - stage: Push
+    displayName: Push to Registry
+    dependsOn: [Build, SecurityScan]
+    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
+    jobs:
+      - job: PushJob
+        displayName: Push Docker Image
+        pool:
+          vmImage: $(vmImageName)
+
+        steps:
+          - task: Docker@2
+            displayName: Login to ACR
+            inputs:
+              command: login
+              containerRegistry: 'MyACR'
+
+          - task: Docker@2
+            displayName: Push image
+            inputs:
+              command: push
+              repository: $(imageRepository)
+              tags: |
+                $(tag)
+                latest
+
+  # Stage 4: Deploy to Development
+  - stage: DeployDev
+    displayName: Deploy to Development
+    dependsOn: Push
+    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/develop'))
+    jobs:
+      - deployment: DeployDev
+        displayName: Deploy to Dev Environment
+        pool:
+          vmImage: $(vmImageName)
+        environment: 'development'
+        strategy:
+          runOnce:
+            deploy:
+              steps:
+                - task: KubernetesManifest@0
+                  displayName: Deploy to Kubernetes
+                  inputs:
+                    action: 'deploy'
+                    namespace: 'dev'
+                    manifests: |
+                      $(Pipeline.Workspace)/manifests/deployment.yaml
+                      $(Pipeline.Workspace)/manifests/service.yaml
+                    containers: |
+                      $(containerRegistry)/$(imageRepository):$(tag)
+
+                - script: |
+                    curl -f https://dev.example.com/health
+                  displayName: Health check
+
+  # Stage 5: Deploy to Production
+  - stage: DeployProd
+    displayName: Deploy to Production
+    dependsOn: Push
+    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
+    jobs:
+      - deployment: DeployProd
+        displayName: Deploy to Production
+        pool:
+          vmImage: $(vmImageName)
+        environment: 'production'
+        strategy:
+          runOnce:
+            deploy:
+              steps:
+                - task: KubernetesManifest@0
+                  displayName: Deploy to Kubernetes
+                  inputs:
+                    action: 'deploy'
+                    namespace: 'prod'
+                    manifests: |
+                      $(Pipeline.Workspace)/manifests/deployment.yaml
+                      $(Pipeline.Workspace)/manifests/service.yaml
+                    containers: |
+                      $(containerRegistry)/$(imageRepository):$(tag)
+
+                - task: Kubernetes@1
+                  displayName: Check deployment status
+                  inputs:
+                    command: 'get'
+                    arguments: 'pods -n prod -l app=$(imageRepository)'
+
+                - script: |
+                    curl -f https://example.com/health
+                  displayName: Production health check
+```
+
+## Pipeline Features
+
+### 1. Security Scanning Integration
+
+**From Context7 best practices:**
+
+```yaml
+- name: Dependency vulnerability scan
+  run: npm audit --audit-level=moderate
+
+- name: SAST with Semgrep
+  uses: returntocorp/semgrep-action@v1
+
+- name: Container image scan with Trivy
+  uses: aquasecurity/trivy-action@master
+  with:
+    image-ref: ${{ env.IMAGE }}
+    severity: 'CRITICAL,HIGH'
+    exit-code: '1'
+
+- name: Secret scanning
+  uses: trufflesecurity/trufflehog@main
+  with:
+    path: ./
+    base: ${{ github.event.repository.default_branch }}
+    head: HEAD
+```
+
+### 2. Caching Strategies
+
+**From Context7 (/docker/docs):**
+
+```yaml
+- name: Cache dependencies
+  uses: actions/cache@v3
+  with:
+    path: ~/.npm
+    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+    restore-keys: |
+      ${{ runner.os }}-node-
+
+- name: Docker layer caching
+  uses: docker/build-push-action@v5
+  with:
+    cache-from: type=gha
+    cache-to: type=gha,mode=max
+```
+
+### 3. Matrix Builds
+
+```yaml
+strategy:
+  matrix:
+    node: [16, 18, 20]
+    os: [ubuntu-latest, windows-latest, macos-latest]
+    include:
+      - node: 18
+        os: ubuntu-latest
+        coverage: true
+```
+
+### 4. Environment Protection
+
+```yaml
+environment:
+  name: production
+  url: https://example.com
+  protection-rules:
+    required-reviewers: 2
+    wait-timer: 15
+    deployment-branch-policy:
+      allowed-branches:
+        - main
+```
+
+## Implementation
+
+This command uses specialized agents:
+- **@github-operations-specialist** - GitHub Actions
+- **@azure-devops-specialist** - Azure Pipelines
+- **@docker-containerization-expert** - Container builds
+- **@kubernetes-orchestrator** - K8s deployments
+
+Process:
+1. Query Context7 for platform-specific patterns
+2. Analyze project structure and type
+3. Generate pipeline configuration
+4. Add security scanning stages
+5. Configure deployment strategies
+6. Set up notifications and monitoring
+
+## Best Practices Applied
+
+1. **Multi-Stage Pipelines** - Build, test, scan, deploy
+2. **Security First** - Scanning in every stage
+3. **Caching** - Dependencies and Docker layers
+4. **Matrix Builds** - Multiple versions tested
+5. **Environment Protection** - Manual approval gates
+6. **Secrets Management** - Never in code
+7. **Artifact Management** - Proper versioning
+8. **Monitoring Integration** - Deployment tracking
+9. **Rollback Strategy** - Easy reversion
+10. **Documentation** - Self-documenting YAML
+
+## Related Commands
+
+- `/workflow-create` - GitHub workflow creation
+- `/docker:optimize` - Docker image optimization
+- `/cloud:validate` - Infrastructure validation
+- `/security:scan` - Security vulnerability scanning
+
+## Troubleshooting
+
+### Pipeline Failures
+- Check secret configuration in platform settings
+- Verify permissions for deployment targets
+- Review logs for specific error messages
+
+### Slow Build Times
+- Enable caching for dependencies
+- Use Docker layer caching
+- Parallelize independent jobs
+
+### Deployment Issues
+- Verify environment configuration
+- Check deployment credentials
+- Review health check endpoints
+
+## Version History
+
+- v2.0.0 - Initial Schema v2.0 release
+- Multi-platform support (GitHub, Azure, GitLab)
+- Security scanning integration
+- Matrix build support
+- Environment protection rules