opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/constraint-driven-development/references/floor-guard.md

@@ -0,0 +1,99 @@
+# Floor guard: reference implementation
+
+Every numbered dimension in `CONSTRAINTS.md` maps to a de facto tool (Step 4). The **floor** does not: it is a diff-scoped check for the five moves in Step 6, and without a shipped reference every agent invents its own, so two runs (or a Python repo and a Go one) produce two different guards. That is the exact non-determinism this skill exists to remove.
+
+This is the reference. Adapt the patterns to your stack; keep the contract identical.
+
+## Contract
+
+- **Input:** the diff between the merge base and the working tree (added *and* removed lines, plus untracked files). A guard that reads only `git diff` misses new files and staged-but-uncommitted work.
+- **Detects the five Step 6 moves:** a weakened threshold in `CONSTRAINTS.md`, a test made easier (`.skip`, a deleted test file, an assertion removed from a test that stayed), a silenced checker (a new suppression comment), unfinished work (a stub or empty `catch`), a new Exceptions row.
+- **Exit codes:** `0` clean, `1` at least one floor violation (block the change), `2` the guard could not run (no merge base, not a git repo). Never let a `2` read as a `0`.
+- **Reports the rule and the location, never the matched secret value.** Redaction is not optional (Step 4).
+- **Tightening is silent, loosening is loud:** only surfaces moves that lower the bar.
+
+## Reference (Node, ~stack-agnostic patterns)
+
+```js
+#!/usr/bin/env node
+// floor-guard.mjs — diff-scoped enforcement of the CONSTRAINTS.md floor.
+// Usage: node floor-guard.mjs [--base <ref>]   (default base: origin/main)
+import { execFileSync } from 'node:child_process';
+
+const base = (() => {
+  const i = process.argv.indexOf('--base');
+  return i > -1 ? process.argv[i + 1] : 'origin/main';
+})();
+
+const git = (args) => {
+  try { return execFileSync('git', args, { encoding: 'utf8' }); }
+  catch { return null; }
+};
+
+// Merge base; bail to exit 2 rather than pretending a shallow/rootless clone is clean.
+const mergeBase = git(['merge-base', base, 'HEAD'])?.trim();
+if (!mergeBase) { console.error('floor-guard: no merge base against ' + base); process.exit(2); }
+
+// Unified diff plus untracked files (git diff alone cannot see new files).
+const tracked = git(['diff', '--unified=0', mergeBase, '--']) ?? '';
+const untracked = (git(['ls-files', '--others', '--exclude-standard']) ?? '')
+  .split('\n').filter(Boolean)
+  .map((f) => git(['diff', '--no-index', '--unified=0', '/dev/null', f]) ?? '')
+  .join('\n');
+const diff = tracked + '\n' + untracked;
+
+const added = [], removed = [];
+let file = '';
+for (const line of diff.split('\n')) {
+  if (line.startsWith('+++ ')) file = line.slice(6);
+  else if (line.startsWith('+') && !line.startsWith('+++')) added.push({ file, text: line.slice(1) });
+  else if (line.startsWith('-') && !line.startsWith('---')) removed.push({ file, text: line.slice(1) });
+}
+
+const findings = [];
+const flag = (rule, f, text) => findings.push({ rule, file: f, text: text.trim().slice(0, 120) });
+
+// 1. Silenced checker — extend this list for your ecosystem.
+const SUPPRESSIONS = /@ts-ignore|@ts-nocheck|eslint-disable|biome-ignore|# *noqa|# *type: *ignore|istanbul ignore|nosemgrep|gitleaks:allow|Stryker disable/;
+// 4. Unfinished work.
+const STUBS = /throw new (Error|NotImplemented).*[Nn]ot implemented|catch\s*\(\w*\)\s*\{\s*\}|catch\s*\{\s*\}|\bTODO\b|\bpass\s*# *stub/;
+// 2. A test made easier (added skips).
+const SKIPS = /\.(skip|todo)\b|\bxit\(|\bxdescribe\(|@pytest\.mark\.skip|t\.Skip\(/;
+
+for (const { file, text } of added) {
+  if (SUPPRESSIONS.test(text)) flag('silenced-checker', file, text);
+  if (STUBS.test(text)) flag('unfinished-work', file, text);
+  if (SKIPS.test(text)) flag('test-made-easier', file, text);
+  if (/CONSTRAINTS\.md$/.test(file) && /^\| *(W|E)\d+ *\|/.test(text)) flag('new-exception', file, text);
+}
+
+// 2b. Assertion removed from a test file that still exists.
+for (const { file, text } of removed) {
+  if (/\.(test|spec)\.|_test\.|test_/.test(file) && /\b(expect|assert|should)\b/.test(text)) {
+    flag('assertion-removed', file, text);
+  }
+}
+
+// 1b/2c. Weakened threshold: a number in CONSTRAINTS.md that went down, or a floor bullet deleted.
+const nums = (s) => (s.match(/\d+(\.\d+)?/g) || []).map(Number);
+const removedConstraints = removed.filter((l) => /CONSTRAINTS\.md$/.test(l.file));
+const addedConstraints = added.filter((l) => /CONSTRAINTS\.md$/.test(l.file));
+for (const r of removedConstraints) {
+  const a = addedConstraints.find((x) => x.text.split(/[|:]/)[0] === r.text.split(/[|:]/)[0]);
+  if (a && nums(a.text).some((n, i) => nums(r.text)[i] !== undefined && n < nums(r.text)[i])) {
+    flag('threshold-lowered', r.file, r.text + '  ->  ' + a.text);
+  }
+}
+
+if (findings.length === 0) { console.log('floor-guard: clean'); process.exit(0); }
+console.error('floor-guard: ' + findings.length + ' floor violation(s):');
+for (const f of findings) console.error(`  [${f.rule}] ${f.file}: ${f.text}`);
+console.error('\nEach is a move that lowers the bar. Fix the code, or route it through a tracked exception.');
+process.exit(1);
+```
+
+## Adapting it
+
+- **Patterns are the only stack-specific part.** Add your language's suppression and stub forms to the three regexes; the diff plumbing, the CONSTRAINTS.md checks, and the exit codes stay as-is.
+- **A `.constraintsignore`** (one glob per line) lets you exempt a path the guard would otherwise flag; check each added line's file against it before flagging, so a genuine exception is a tracked file rather than a loosened rule.
+- **This is a starting point, not a finished tool.** It is deliberately regex-shallow: it catches the cheap-road-to-green moves agents actually make, not a determined human hiding a change. That is the right trade for a check that runs on every diff. Once you outgrow it, move to a real runner (Escalation Path level 3).

package/bundled-skills/container-hardening/SKILL.md

@@ -0,0 +1,126 @@
+---
+name: container-hardening
+description: Secure Docker images and container runtime configurations.
+category: security
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant security tooling (scanners, vault CLIs) and an
+  authorized scope for any active assessment. Docs-only; helper scripts and templates
+  not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Container Hardening
+
+Secure container images and runtime configurations.
+
+## When to Use This Skill
+
+Use this skill when:
+- Building secure container images
+- Hardening container deployments
+- Meeting container security requirements
+- Implementing defense in depth
+
+## Dockerfile Security
+
+```dockerfile
+# Use minimal base image
+FROM alpine:3.18
+
+# Don't run as root
+RUN addgroup -g 1001 -S appgroup && \
+    adduser -u 1001 -S appuser -G appgroup
+
+# Copy with specific ownership
+COPY --chown=appuser:appgroup . /app
+
+# Remove unnecessary packages
+RUN apk del --purge build-dependencies && \
+    rm -rf /var/cache/apk/*
+
+# Use non-root user
+USER appuser
+
+# Read-only filesystem support
+WORKDIR /app
+```
+
+## Runtime Security
+
+```bash
+# Run with security options
+docker run -d \
+  --read-only \
+  --tmpfs /tmp \
+  --security-opt=no-new-privileges:true \
+  --cap-drop=ALL \
+  --cap-add=NET_BIND_SERVICE \
+  --user 1001:1001 \
+  myapp:latest
+```
+
+## Kubernetes Security Context
+
+```yaml
+apiVersion: v1
+kind: Pod
+spec:
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1001
+    fsGroup: 1001
+  containers:
+  - name: app
+    securityContext:
+      allowPrivilegeEscalation: false
+      readOnlyRootFilesystem: true
+      capabilities:
+        drop: ["ALL"]
+```
+
+## Image Scanning
+
+```bash
+# Scan with Trivy
+trivy image --severity HIGH,CRITICAL myapp:latest
+
+# Use distroless images
+FROM gcr.io/distroless/static-debian11
+```
+
+## Best Practices
+
+- Use minimal base images
+- Run as non-root user
+- Enable read-only filesystem
+- Drop all capabilities
+- Scan images regularly
+- Sign and verify images
+- Use secrets management
+
+## Related Skills
+
+- container-scanning (`container-scanning`) - Vulnerability scanning
+- kubernetes-hardening (`kubernetes-hardening`) - K8s security
+
+## Limitations
+
+- Apply guidance only within authorized scope; test destructive steps in non-production first.
+- Docs-only import: upstream scripts and templates not bundled.
+
+### Example
+
+```bash
+# Read-only first: inventory before any active step.
+which <tool> && <tool> --help | head -n 20
+```
+
+> Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.

package/bundled-skills/container-registries/SKILL.md

@@ -0,0 +1,435 @@
+---
+name: container-registries
+description: Manage container registries including ECR, ACR, GCR, and Docker Hub.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant platform CLIs (kubectl, helm, terraform, git,
+  CI runners) and authorized access to the target environment. Docs-only; helper scripts
+  and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Container Registries
+
+Store, manage, and distribute container images across cloud and self-hosted registries.
+
+## When to Use This Skill
+
+Use this skill when:
+- Pushing and pulling container images
+- Configuring registry authentication
+- Setting up image retention policies
+- Managing private container registries
+- Implementing image scanning and security
+
+## Prerequisites
+
+- Docker or Podman installed
+- Cloud CLI tools (AWS CLI, az, gcloud) for respective registries
+- Appropriate IAM permissions
+
+## Docker Hub
+
+### Authentication
+
+```bash
+# Login
+docker login
+
+# Login with token
+echo "$DOCKER_TOKEN" | docker login -u username --password-stdin
+```
+
+### Push/Pull Images
+
+```bash
+# Tag image
+docker tag myapp:latest username/myapp:latest
+
+# Push
+docker push username/myapp:latest
+
+# Pull
+docker pull username/myapp:latest
+```
+
+### Automated Builds
+
+Configure in Docker Hub UI:
+1. Connect GitHub/Bitbucket repository
+2. Set build rules (branch → tag mapping)
+3. Configure build context and Dockerfile path
+
+## Amazon ECR
+
+### Setup
+
+```bash
+# Create repository
+aws ecr create-repository \
+  --repository-name myapp \
+  --image-scanning-configuration scanOnPush=true \
+  --encryption-configuration encryptionType=AES256
+
+# Get registry URI
+REGISTRY=$(aws ecr describe-repositories \
+  --repository-names myapp \
+  --query 'repositories[0].repositoryUri' \
+  --output text | cut -d'/' -f1)
+```
+
+### Authentication
+
+```bash
+# Login (Docker)
+aws ecr get-login-password --region us-east-1 | \
+  docker login --username AWS --password-stdin $REGISTRY
+
+# Login with credential helper
+# Add to ~/.docker/config.json:
+{
+  "credHelpers": {
+    "123456789.dkr.ecr.us-east-1.amazonaws.com": "ecr-login"
+  }
+}
+```
+
+### Push/Pull
+
+```bash
+# Tag and push
+docker tag myapp:latest $REGISTRY/myapp:latest
+docker push $REGISTRY/myapp:latest
+
+# Pull
+docker pull $REGISTRY/myapp:latest
+```
+
+### Lifecycle Policy
+
+```bash
+# Create lifecycle policy
+aws ecr put-lifecycle-policy \
+  --repository-name myapp \
+  --lifecycle-policy-text '{
+    "rules": [
+      {
+        "rulePriority": 1,
+        "description": "Keep last 10 images",
+        "selection": {
+          "tagStatus": "any",
+          "countType": "imageCountMoreThan",
+          "countNumber": 10
+        },
+        "action": {
+          "type": "expire"
+        }
+      }
+    ]
+  }'
+```
+
+### Repository Policy
+
+```bash
+# Allow cross-account access
+aws ecr set-repository-policy \
+  --repository-name myapp \
+  --policy-text '{
+    "Version": "2012-10-17",
+    "Statement": [
+      {
+        "Sid": "CrossAccountPull",
+        "Effect": "Allow",
+        "Principal": {
+          "AWS": "arn:aws:iam::OTHER_ACCOUNT:root"
+        },
+        "Action": [
+          "ecr:GetDownloadUrlForLayer",
+          "ecr:BatchGetImage"
+        ]
+      }
+    ]
+  }'
+```
+
+## Azure Container Registry (ACR)
+
+### Setup
+
+```bash
+# Create registry
+az acr create \
+  --resource-group mygroup \
+  --name myregistry \
+  --sku Standard \
+  --admin-enabled false
+
+# Get login server
+az acr show --name myregistry --query loginServer -o tsv
+```
+
+### Authentication
+
+```bash
+# Login with Azure CLI
+az acr login --name myregistry
+
+# Login with service principal
+docker login myregistry.azurecr.io \
+  -u $SP_APP_ID \
+  -p $SP_PASSWORD
+
+# Get access token
+az acr login --name myregistry --expose-token
+```
+
+### Push/Pull
+
+```bash
+# Tag and push
+docker tag myapp:latest myregistry.azurecr.io/myapp:latest
+docker push myregistry.azurecr.io/myapp:latest
+
+# ACR Build (build in cloud)
+az acr build \
+  --registry myregistry \
+  --image myapp:latest \
+  --file Dockerfile .
+```
+
+### Retention Policy
+
+```bash
+# Enable retention policy
+az acr config retention update \
+  --registry myregistry \
+  --status enabled \
+  --days 30 \
+  --type UntaggedManifests
+```
+
+### Geo-Replication
+
+```bash
+# Enable replication
+az acr replication create \
+  --registry myregistry \
+  --location westeurope
+
+# List replications
+az acr replication list --registry myregistry
+```
+
+## Google Container Registry (GCR) / Artifact Registry
+
+### Setup (Artifact Registry)
+
+```bash
+# Create repository
+gcloud artifacts repositories create myrepo \
+  --repository-format=docker \
+  --location=us-central1 \
+  --description="Docker repository"
+```
+
+### Authentication
+
+```bash
+# Configure Docker auth
+gcloud auth configure-docker us-central1-docker.pkg.dev
+
+# Or use credential helper
+gcloud auth print-access-token | \
+  docker login -u oauth2accesstoken --password-stdin \
+  https://us-central1-docker.pkg.dev
+```
+
+### Push/Pull
+
+```bash
+# Tag for Artifact Registry
+docker tag myapp:latest \
+  us-central1-docker.pkg.dev/PROJECT_ID/myrepo/myapp:latest
+
+# Push
+docker push us-central1-docker.pkg.dev/PROJECT_ID/myrepo/myapp:latest
+
+# Pull
+docker pull us-central1-docker.pkg.dev/PROJECT_ID/myrepo/myapp:latest
+```
+
+### Cleanup Policy
+
+```bash
+# Create cleanup policy
+gcloud artifacts repositories set-cleanup-policies myrepo \
+  --location=us-central1 \
+  --policy=policy.json
+
+# policy.json
+{
+  "name": "delete-old",
+  "action": {"type": "Delete"},
+  "condition": {
+    "olderThan": "30d",
+    "tagState": "untagged"
+  }
+}
+```
+
+## GitHub Container Registry (GHCR)
+
+### Authentication
+
+```bash
+# Login with PAT
+echo "$GITHUB_TOKEN" | docker login ghcr.io -u USERNAME --password-stdin
+```
+
+### Push/Pull
+
+```bash
+# Tag
+docker tag myapp:latest ghcr.io/OWNER/myapp:latest
+
+# Push
+docker push ghcr.io/OWNER/myapp:latest
+
+# Pull
+docker pull ghcr.io/OWNER/myapp:latest
+```
+
+### Visibility Settings
+
+Configure in GitHub:
+1. Go to package settings
+2. Change visibility (public/private)
+3. Manage access for teams/users
+
+## Self-Hosted Registry
+
+### Deploy with Docker
+
+```bash
+# Run registry
+docker run -d -p 5000:5000 \
+  --name registry \
+  -v registry-data:/var/lib/registry \
+  registry:2
+
+# Configure TLS
+docker run -d -p 443:5000 \
+  --name registry \
+  -v /certs:/certs \
+  -v registry-data:/var/lib/registry \
+  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
+  -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
+  registry:2
+```
+
+### Harbor Registry
+
+```bash
+# Download Harbor
+wget https://github.com/goharbor/harbor/releases/download/v2.9.0/harbor-online-installer-v2.9.0.tgz
+tar xzvf harbor-online-installer-v2.9.0.tgz
+
+# Configure harbor.yml
+# Set hostname, https certificate, admin password
+
+# Install
+./install.sh --with-trivy --with-chartmuseum
+```
+
+## Image Security
+
+### Vulnerability Scanning
+
+```bash
+# ECR - Enable scan on push
+aws ecr put-image-scanning-configuration \
+  --repository-name myapp \
+  --image-scanning-configuration scanOnPush=true
+
+# Get scan results
+aws ecr describe-image-scan-findings \
+  --repository-name myapp \
+  --image-id imageTag=latest
+
+# ACR - Scan with Defender
+az acr task create \
+  --registry myregistry \
+  --name scan-images \
+  --cmd "mcr.microsoft.com/azure-cli az acr run-scan"
+```
+
+### Image Signing
+
+```bash
+# Enable content trust
+export DOCKER_CONTENT_TRUST=1
+
+# Sign image on push
+docker push myregistry/myapp:latest
+
+# Verify signature
+docker trust inspect myregistry/myapp:latest
+```
+
+## Common Issues
+
+### Issue: Authentication Expired
+**Problem**: Push/pull fails with auth error
+**Solution**: Re-run login command, check credential helper
+
+### Issue: Image Not Found
+**Problem**: Pull fails with manifest unknown
+**Solution**: Verify tag exists, check registry URL
+
+### Issue: Push Permission Denied
+**Problem**: Cannot push to repository
+**Solution**: Check IAM permissions, verify repository exists
+
+### Issue: Rate Limiting (Docker Hub)
+**Problem**: Too many requests error
+**Solution**: Authenticate for higher limits, use pull-through cache
+
+## Best Practices
+
+- Enable vulnerability scanning on all repositories
+- Implement lifecycle policies to manage storage costs
+- Use immutable tags for production images
+- Configure cross-region replication for availability
+- Use service accounts/principals for CI/CD authentication
+- Enable audit logging for compliance
+- Implement image signing for supply chain security
+- Use pull-through cache to avoid rate limits
+
+## Related Skills
+
+- docker-management (`docker-management`) - Building images
+- container-scanning (`container-scanning`) - Security scanning
+- aws-iam (`aws-iam`) - AWS permissions
+
+## Limitations
+
+- Guidance executes against real environments: confirm target, blast radius, and rollback plan before applying anything.
+- Never deploy to production without explicit approval. Docs-only import: upstream scripts and templates not bundled.
+
+### Example
+
+```bash
+git status && git diff --stat
+kubectl diff -f manifest.yaml
+```
+
+> Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.