javi-forge 0.1.0

package/templates/gitlab/gitlab-ci-go.yml

@@ -0,0 +1,88 @@
+# =============================================================================
+# GitLab CI - Go Project
+# =============================================================================
+# Minimal CI for Go projects. Copy to your project as .gitlab-ci.yml
+#
+# Features:
+#   - Build verification only (tests run locally via CI-Local)
+#   - Merge request, manual trigger, or tag-based releases
+#   - Docker publish on tags
+# =============================================================================
+
+image: golang:1.23-bookworm
+
+variables:
+  GOPROXY: "https://proxy.golang.org,direct"
+  GOFLAGS: "-mod=readonly"
+
+stages:
+  - build
+  - publish
+
+# Cache Go modules
+cache:
+  key: ${CI_COMMIT_REF_SLUG}
+  paths:
+    - .go/pkg/mod/
+
+before_script:
+  - mkdir -p .go
+  - export GOPATH="$CI_PROJECT_DIR/.go"
+  - export PATH="$GOPATH/bin:$PATH"
+
+# =============================================================================
+# Lint with golangci-lint - Reports failures without blocking pipeline
+# =============================================================================
+lint:
+  stage: build
+  allow_failure: true
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_TAG
+    - when: manual
+      allow_failure: true
+  before_script:
+    - mkdir -p .go
+    - export GOPATH="$CI_PROJECT_DIR/.go"
+    - export PATH="$GOPATH/bin:$PATH"
+    - go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+  script:
+    - golangci-lint run --timeout 5m
+
+# =============================================================================
+# Build - On merge requests, tags, or manual
+# =============================================================================
+build:
+  stage: build
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_TAG
+    - when: manual
+      allow_failure: true
+  script:
+    - go mod download
+    - go mod verify
+    - go build -v ./...
+    - go vet ./...
+  artifacts:
+    paths:
+      - bin/
+    expire_in: 1 week
+
+# =============================================================================
+# Docker - Only on version tags
+# =============================================================================
+# docker:
+#   stage: publish
+#   image: docker:24
+#   services:
+#     - docker:24-dind
+#   rules:
+#     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+#   before_script:
+#     - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+#   script:
+#     - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG .
+#     - docker build -t $CI_REGISTRY_IMAGE:latest .
+#     - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
+#     - docker push $CI_REGISTRY_IMAGE:latest

package/templates/gitlab/gitlab-ci-java.yml

@@ -0,0 +1,79 @@
+# ===========================================
+# GitLab CI for Java/Gradle Projects
+# ===========================================
+# Copy to: .gitlab-ci.yml
+#
+# MINIMAL CI - runs on merge requests, tags, and manual triggers.
+# Run full validation locally: ./.ci-local/ci-local.sh full
+# ===========================================
+
+image: eclipse-temurin:21-jdk  # Change: 17, 21, 25
+
+stages:
+  - build
+  - publish
+  - docker
+
+variables:
+  GRADLE_OPTS: "-Dorg.gradle.daemon=false -Dorg.gradle.caching=true"
+  GRADLE_USER_HOME: "${CI_PROJECT_DIR}/.gradle"
+
+cache:
+  key: "${CI_COMMIT_REF_SLUG}"
+  paths:
+    - .gradle/
+    - build/
+
+# ===========================================
+# LINT - Reports failures without blocking pipeline
+# ===========================================
+lint:
+  stage: build
+  allow_failure: true
+  script:
+    - chmod +x gradlew
+    - ./gradlew spotlessCheck --no-daemon
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+    - when: manual
+      allow_failure: true
+
+# ===========================================
+# BUILD - On merge requests, tags, or manual
+# ===========================================
+build:
+  stage: build
+  script:
+    - chmod +x gradlew
+    - ./gradlew classes --no-daemon
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+    - when: manual
+      allow_failure: true
+
+# ===========================================
+# PUBLISH - Only on version tags
+# ===========================================
+# publish:
+#   stage: publish
+#   needs: ["build"]
+#   script:
+#     - ./gradlew publish --no-daemon
+#   rules:
+#     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+
+# ===========================================
+# DOCKER - Only on version tags
+# ===========================================
+# docker:
+#   stage: docker
+#   image: docker:24
+#   services:
+#     - docker:24-dind
+#   script:
+#     - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG .
+#     - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
+#   rules:
+#     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/

package/templates/gitlab/gitlab-ci-monorepo.yml

@@ -0,0 +1,126 @@
+# ===========================================
+# GitLab CI for Monorepo Projects
+# ===========================================
+# Copy to: .gitlab-ci.yml
+#
+# MINIMAL CI - runs on merge requests, tags, and manual triggers.
+# Uses rules:changes to detect which service changed.
+# Run full validation locally: ./.ci-local/ci-local.sh full
+# ===========================================
+
+stages:
+  - build
+  - docker
+
+# ===========================================
+# FRONTEND LINT (Node.js) - Reports failures without blocking pipeline
+# ===========================================
+frontend-lint:
+  stage: build
+  image: node:20-alpine
+  allow_failure: true
+  script:
+    - cd packages/frontend
+    - npm ci
+    - npm run lint
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      changes:
+        - packages/frontend/**/*
+    - if: $CI_COMMIT_TAG
+      changes:
+        - packages/frontend/**/*
+    - when: manual
+      allow_failure: true
+
+# ===========================================
+# FRONTEND BUILD (Node.js)
+# ===========================================
+frontend:
+  stage: build
+  image: node:20-alpine
+  script:
+    - cd packages/frontend
+    - npm ci
+    - npm run build
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      changes:
+        - packages/frontend/**/*
+    - if: $CI_COMMIT_TAG
+      changes:
+        - packages/frontend/**/*
+    - when: manual
+      allow_failure: true
+
+# ===========================================
+# BACKEND LINT (Java/Gradle) - Reports failures without blocking pipeline
+# ===========================================
+backend-lint:
+  stage: build
+  image: eclipse-temurin:21-jdk
+  allow_failure: true
+  variables:
+    GRADLE_OPTS: "-Dorg.gradle.daemon=false"
+  script:
+    - cd packages/backend
+    - chmod +x gradlew
+    - ./gradlew spotlessCheck --no-daemon
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      changes:
+        - packages/backend/**/*
+    - if: $CI_COMMIT_TAG
+      changes:
+        - packages/backend/**/*
+    - when: manual
+      allow_failure: true
+
+# ===========================================
+# BACKEND BUILD (Java/Gradle)
+# ===========================================
+backend:
+  stage: build
+  image: eclipse-temurin:21-jdk
+  variables:
+    GRADLE_OPTS: "-Dorg.gradle.daemon=false"
+  script:
+    - cd packages/backend
+    - chmod +x gradlew
+    - ./gradlew classes --no-daemon
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      changes:
+        - packages/backend/**/*
+    - if: $CI_COMMIT_TAG
+      changes:
+        - packages/backend/**/*
+    - when: manual
+      allow_failure: true
+
+# ===========================================
+# DOCKER - Only on version tags
+# ===========================================
+# docker-frontend:
+#   stage: docker
+#   image: docker:24
+#   services:
+#     - docker:24-dind
+#   needs: ["frontend"]
+#   script:
+#     - docker build -t $CI_REGISTRY_IMAGE/frontend:$CI_COMMIT_TAG packages/frontend
+#     - docker push $CI_REGISTRY_IMAGE/frontend:$CI_COMMIT_TAG
+#   rules:
+#     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+
+# docker-backend:
+#   stage: docker
+#   image: docker:24
+#   services:
+#     - docker:24-dind
+#   needs: ["backend"]
+#   script:
+#     - docker build -t $CI_REGISTRY_IMAGE/backend:$CI_COMMIT_TAG packages/backend
+#     - docker push $CI_REGISTRY_IMAGE/backend:$CI_COMMIT_TAG
+#   rules:
+#     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/

package/templates/gitlab/gitlab-ci-node.yml

@@ -0,0 +1,63 @@
+# ===========================================
+# GitLab CI for Node.js Projects
+# ===========================================
+# Copy to: .gitlab-ci.yml
+#
+# MINIMAL CI - runs on merge requests, tags, and manual triggers.
+# Run full validation locally: ./.ci-local/ci-local.sh full
+# ===========================================
+
+image: node:20-alpine  # Change: 18, 20, 22
+
+stages:
+  - build
+  - docker
+
+cache:
+  key: "${CI_COMMIT_REF_SLUG}"
+  paths:
+    - node_modules/
+    - .npm/
+
+# ===========================================
+# LINT - Reports failures without blocking pipeline
+# ===========================================
+lint:
+  stage: build
+  allow_failure: true
+  script:
+    - npm ci
+    - npm run lint
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+    - when: manual
+      allow_failure: true
+
+# ===========================================
+# BUILD - On merge requests, tags, or manual
+# ===========================================
+build:
+  stage: build
+  script:
+    - npm ci
+    - npm run build
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+    - when: manual
+      allow_failure: true
+
+# ===========================================
+# DOCKER - Only on version tags
+# ===========================================
+# docker:
+#   stage: docker
+#   image: docker:24
+#   services:
+#     - docker:24-dind
+#   script:
+#     - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG .
+#     - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
+#   rules:
+#     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/

package/templates/gitlab/gitlab-ci-python.yml

@@ -0,0 +1,147 @@
+# =============================================================================
+# GitLab CI - Python Project
+# =============================================================================
+# Minimal CI for Python projects. Copy to your project as .gitlab-ci.yml
+#
+# Features:
+#   - Build verification only (tests run locally via CI-Local)
+#   - Manual trigger, merge request, or tag-based releases
+#   - Supports pip, poetry, and uv
+# =============================================================================
+
+image: python:3.12-slim
+
+variables:
+  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.pip-cache"
+  POETRY_HOME: "$CI_PROJECT_DIR/.poetry"
+  POETRY_VIRTUALENVS_IN_PROJECT: "true"
+
+stages:
+  - build
+  - publish
+
+# Cache pip/poetry dependencies
+cache:
+  key: ${CI_COMMIT_REF_SLUG}
+  paths:
+    - .pip-cache/
+    - .venv/
+    - .poetry/
+
+# =============================================================================
+# Lint with pip - Reports failures without blocking pipeline
+# =============================================================================
+lint-pip:
+  stage: build
+  allow_failure: true
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && ($PACKAGE_MANAGER == "pip" || $PACKAGE_MANAGER == null)
+    - if: $CI_COMMIT_TAG && ($PACKAGE_MANAGER == "pip" || $PACKAGE_MANAGER == null)
+    - if: ($PACKAGE_MANAGER == "pip" || $PACKAGE_MANAGER == null)
+      when: manual
+      allow_failure: true
+  script:
+    - python -m pip install --upgrade pip
+    - pip install ruff mypy
+    - ruff check .
+    - mypy . --ignore-missing-imports
+
+# =============================================================================
+# Build with pip
+# =============================================================================
+build-pip:
+  stage: build
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && ($PACKAGE_MANAGER == "pip" || $PACKAGE_MANAGER == null)
+    - if: $CI_COMMIT_TAG && ($PACKAGE_MANAGER == "pip" || $PACKAGE_MANAGER == null)
+    - if: ($PACKAGE_MANAGER == "pip" || $PACKAGE_MANAGER == null)
+      when: manual
+      allow_failure: true
+  script:
+    - python -m pip install --upgrade pip
+    - pip install -r requirements.txt || true
+    - pip install -r requirements-dev.txt || true
+
+# =============================================================================
+# Lint with Poetry - Reports failures without blocking pipeline
+# =============================================================================
+lint-poetry:
+  stage: build
+  allow_failure: true
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $PACKAGE_MANAGER == "poetry"
+    - if: $CI_COMMIT_TAG && $PACKAGE_MANAGER == "poetry"
+    - if: $PACKAGE_MANAGER == "poetry"
+      when: manual
+      allow_failure: true
+  before_script:
+    - pip install poetry
+    - export PATH="$POETRY_HOME/bin:$PATH"
+  script:
+    - poetry install
+    - poetry run ruff check .
+    - poetry run mypy . --ignore-missing-imports
+
+# =============================================================================
+# Build with Poetry
+# =============================================================================
+build-poetry:
+  stage: build
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $PACKAGE_MANAGER == "poetry"
+    - if: $CI_COMMIT_TAG && $PACKAGE_MANAGER == "poetry"
+    - if: $PACKAGE_MANAGER == "poetry"
+      when: manual
+      allow_failure: true
+  before_script:
+    - pip install poetry
+    - export PATH="$POETRY_HOME/bin:$PATH"
+  script:
+    - poetry install
+
+# =============================================================================
+# Lint with uv - Reports failures without blocking pipeline
+# =============================================================================
+lint-uv:
+  stage: build
+  allow_failure: true
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $PACKAGE_MANAGER == "uv"
+    - if: $CI_COMMIT_TAG && $PACKAGE_MANAGER == "uv"
+    - if: $PACKAGE_MANAGER == "uv"
+      when: manual
+      allow_failure: true
+  before_script:
+    - pip install uv
+  script:
+    - uv sync
+    - uv run ruff check .
+    - uv run mypy . --ignore-missing-imports
+
+# =============================================================================
+# Build with uv
+# =============================================================================
+build-uv:
+  stage: build
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event" && $PACKAGE_MANAGER == "uv"
+    - if: $CI_COMMIT_TAG && $PACKAGE_MANAGER == "uv"
+    - if: $PACKAGE_MANAGER == "uv"
+      when: manual
+      allow_failure: true
+  before_script:
+    - pip install uv
+  script:
+    - uv sync
+
+# =============================================================================
+# Publish to PyPI - Only on version tags
+# =============================================================================
+# publish:
+#   stage: publish
+#   rules:
+#     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+#   script:
+#     - pip install build twine
+#     - python -m build
+#     - twine upload dist/* -u __token__ -p $PYPI_TOKEN

package/templates/gitlab/gitlab-ci-rust.yml

@@ -0,0 +1,67 @@
+# ===========================================
+# GitLab CI for Rust Projects
+# ===========================================
+# Copy to: .gitlab-ci.yml
+#
+# MINIMAL CI - runs on merge requests, tags, and manual triggers.
+# Run full validation locally: ./.ci-local/ci-local.sh full
+# ===========================================
+
+image: rust:1.83-slim
+
+stages:
+  - build
+  - release
+
+variables:
+  CARGO_HOME: "${CI_PROJECT_DIR}/.cargo"
+
+cache:
+  key: "${CI_COMMIT_REF_SLUG}"
+  paths:
+    - .cargo/
+    - target/
+
+# ===========================================
+# LINT - Reports failures without blocking pipeline
+# ===========================================
+lint:
+  stage: build
+  allow_failure: true
+  script:
+    - rustup component add clippy rustfmt
+    - cargo fmt --all -- --check
+    - cargo clippy --all-targets -- -D warnings
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+    - when: manual
+      allow_failure: true
+
+# ===========================================
+# BUILD - On merge requests, tags, or manual
+# ===========================================
+build:
+  stage: build
+  script:
+    - cargo build --release
+  artifacts:
+    paths:
+      - target/release/
+    expire_in: 1 hour
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/
+    - when: manual
+      allow_failure: true
+
+# ===========================================
+# RELEASE - Only on version tags
+# ===========================================
+# release:
+#   stage: release
+#   needs: ["build"]
+#   script:
+#     - echo "Uploading release artifacts..."
+#   rules:
+#     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/

package/templates/global/claude-settings.json

@@ -0,0 +1,98 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ~/.ai-config/scripts/hooks/block-dangerous-commands.sh"
+          },
+          {
+            "type": "command",
+            "command": "bash ~/.ai-config/scripts/hooks/commit-guard.sh"
+          }
+        ]
+      },
+      {
+        "matcher": "Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ~/.ai-config/scripts/hooks/secret-scanner.py"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ~/.ai-config/scripts/hooks/validate-workflow.py"
+          }
+        ]
+      },
+      {
+        "matcher": "Edit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ~/.ai-config/scripts/hooks/validate-workflow.py"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ~/.ai-config/scripts/hooks/improve-prompt.py"
+          },
+          {
+            "type": "command",
+            "command": "bash ~/.ai-config/scripts/hooks/model-router.sh"
+          }
+        ]
+      }
+    ]
+  },
+  "permissions": {
+    "deny": [
+      "Read(.env)",
+      "Read(.env.*)",
+      "Read(.env.local)",
+      "Read(.env.production)",
+      "Read(.env.development)",
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(**/secrets/**)",
+      "Read(**/credentials.json)"
+    ],
+    "ask": [
+      "Bash(git commit:*)",
+      "Bash(git push:*)",
+      "Bash(git push --force:*)",
+      "Bash(git rebase:*)",
+      "Bash(git reset --hard:*)"
+    ],
+    "allow": [
+      "Read", "Edit", "Write", "Glob", "Grep",
+      "Bash(git status:*)", "Bash(git diff:*)", "Bash(git add:*)", "Bash(git checkout:*)",
+      "Bash(git branch:*)", "Bash(git log:*)", "Bash(git stash:*)", "Bash(git fetch:*)",
+      "Bash(git pull:*)", "Bash(npm:*)", "Bash(npx:*)", "Bash(pnpm:*)", "Bash(bun:*)",
+      "Bash(yarn:*)", "Bash(eza:*)", "Bash(fd:*)", "Bash(bat:*)", "Bash(rg:*)",
+      "Bash(sd:*)", "Bash(which:*)", "Bash(brew:*)", "Bash(python:*)", "Bash(pip:*)",
+      "Bash(uvx:*)", "Bash(uv:*)", "Bash(cargo:*)", "Bash(rustc:*)", "Bash(go:*)",
+      "Bash(make:*)", "Bash(docker:*)", "Bash(gh:*)", "Bash(code:*)", "Bash(nvim:*)",
+      "Bash(cat:*)", "Bash(ls:*)", "Bash(mkdir:*)", "Bash(cp:*)", "Bash(mv:*)",
+      "Bash(touch:*)", "Bash(chmod:*)", "Bash(head:*)", "Bash(tail:*)", "Bash(wc:*)",
+      "Bash(grep:*)", "Bash(find:*)", "Bash(sed:*)", "Bash(awk:*)", "Bash(curl:*)",
+      "Bash(wget:*)", "Bash(echo:*)", "Bash(printf:*)", "Bash(pwd:*)", "Bash(cd:*)",
+      "Bash(env:*)", "Bash(export:*)", "Bash(source:*)", "Bash(pytest:*)", "Bash(jest:*)",
+      "Bash(vitest:*)", "Bash(ng:*)", "Bash(nx:*)", "Bash(turbo:*)", "WebFetch", "WebSearch"
+    ]
+  }
+}

package/templates/global/codex-config.toml

@@ -0,0 +1,8 @@
+# Codex CLI Configuration
+# https://developers.openai.com/codex/config-reference/
+
+# Model: gpt-5.3-codex | gpt-5.2-codex | gpt-5.1-codex-max | gpt-5.1-codex-mini
+model = "gpt-5.3-codex"
+
+# Approval policy: "on-request" | "on-failure" | "never" | "untrusted" | "reject"
+approval_policy = "on-request"

package/templates/global/copilot-instructions/base-rules.instructions.md

@@ -0,0 +1,13 @@
+---
+applyTo: "**"
+---
+
+# Base Rules
+
+- NO AI attribution in commits, PRs, code or documentation
+- NO destructive commands without confirmation (rm -rf, drop database, truncate)
+- NO commit sensitive files (.env, credentials, secrets)
+- ALWAYS read files before modifying them
+- ALWAYS follow Conventional Commits: type(scope): description
+- ALWAYS validate before push (run tests, lint)
+- Use imperative mood in commit messages, max 72 chars subject line