opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/docker-management/SKILL.md

@@ -0,0 +1,426 @@
+---
+name: docker-management
+description: Build, optimize, and troubleshoot Docker containers and images.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant platform CLIs (kubectl, helm, terraform, git,
+  CI runners) and authorized access to the target environment. Docs-only; helper scripts
+  and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Docker Management
+
+Build, run, and manage Docker containers for application deployment and development.
+
+## When to Use This Skill
+
+Use this skill when:
+- Creating and optimizing Dockerfiles
+- Building and tagging Docker images
+- Running and managing containers
+- Debugging container issues
+- Configuring Docker networking and volumes
+- Implementing container security best practices
+
+## Prerequisites
+
+- Docker Engine installed (20.10+)
+- Basic command line knowledge
+- Understanding of application deployment
+
+## Dockerfile Best Practices
+
+### Multi-Stage Build
+
+```dockerfile
+# Build stage
+FROM node:20-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN npm ci --only=production
+COPY . .
+RUN npm run build
+
+# Production stage
+FROM node:20-alpine AS production
+WORKDIR /app
+RUN addgroup -g 1001 -S nodejs && \
+    adduser -S nodejs -u 1001
+COPY --from=builder --chown=nodejs:nodejs /app/dist ./dist
+COPY --from=builder --chown=nodejs:nodejs /app/node_modules ./node_modules
+USER nodejs
+EXPOSE 3000
+CMD ["node", "dist/index.js"]
+```
+
+### Layer Optimization
+
+```dockerfile
+FROM python:3.12-slim
+
+# Install dependencies first (cached unless requirements change)
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copy application code (changes frequently)
+COPY . .
+
+CMD ["python", "app.py"]
+```
+
+### Security Hardening
+
+```dockerfile
+FROM node:20-alpine
+
+# Create non-root user
+RUN addgroup -g 1001 appgroup && \
+    adduser -u 1001 -G appgroup -D appuser
+
+WORKDIR /app
+
+# Copy with proper ownership
+COPY --chown=appuser:appgroup . .
+
+# Drop privileges
+USER appuser
+
+# Use exec form for proper signal handling
+CMD ["node", "server.js"]
+```
+
+## Building Images
+
+### Basic Build
+
+```bash
+# Build with tag
+docker build -t myapp:1.0 .
+
+# Build with build args
+docker build --build-arg NODE_ENV=production -t myapp:prod .
+
+# Build for specific platform
+docker build --platform linux/amd64 -t myapp:amd64 .
+
+# Build with no cache
+docker build --no-cache -t myapp:fresh .
+```
+
+### Multi-Platform Builds
+
+```bash
+# Create builder
+docker buildx create --name multiplatform --use
+
+# Build for multiple architectures
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  -t myregistry/myapp:latest \
+  --push .
+```
+
+## Running Containers
+
+### Basic Operations
+
+```bash
+# Run container
+docker run -d --name myapp -p 8080:3000 myapp:latest
+
+# Run with environment variables
+docker run -d \
+  -e DATABASE_URL=postgres://localhost/db \
+  -e NODE_ENV=production \
+  myapp:latest
+
+# Run with resource limits
+docker run -d \
+  --memory="512m" \
+  --cpus="1.0" \
+  myapp:latest
+
+# Run with restart policy
+docker run -d --restart=unless-stopped myapp:latest
+```
+
+### Volume Management
+
+```bash
+# Named volume
+docker volume create mydata
+docker run -v mydata:/app/data myapp:latest
+
+# Bind mount
+docker run -v $(pwd)/config:/app/config:ro myapp:latest
+
+# tmpfs mount (memory)
+docker run --tmpfs /tmp:rw,noexec,nosuid myapp:latest
+```
+
+### Networking
+
+```bash
+# Create network
+docker network create mynetwork
+
+# Run on network
+docker run -d --network mynetwork --name api myapp:latest
+
+# Connect existing container
+docker network connect mynetwork existing-container
+
+# Expose specific ports
+docker run -d -p 127.0.0.1:8080:3000 myapp:latest
+```
+
+## Container Lifecycle
+
+### Management Commands
+
+```bash
+# List containers
+docker ps -a
+
+# Stop container
+docker stop myapp
+
+# Remove container
+docker rm myapp
+
+# Force remove running container
+docker rm -f myapp
+
+# Prune stopped containers
+docker container prune -f
+```
+
+### Logs and Monitoring
+
+```bash
+# View logs
+docker logs myapp
+
+# Follow logs
+docker logs -f --tail 100 myapp
+
+# View resource usage
+docker stats myapp
+
+# Inspect container
+docker inspect myapp
+```
+
+## Debugging Containers
+
+### Interactive Access
+
+```bash
+# Execute command in running container
+docker exec -it myapp /bin/sh
+
+# Run container with shell
+docker run -it --rm myapp:latest /bin/sh
+
+# Debug failed container
+docker run -it --entrypoint /bin/sh myapp:latest
+```
+
+### Troubleshooting
+
+```bash
+# Check container logs for errors
+docker logs myapp 2>&1 | grep -i error
+
+# Inspect container state
+docker inspect --format='{{.State.Status}}' myapp
+
+# Check container processes
+docker top myapp
+
+# View container filesystem changes
+docker diff myapp
+
+# Export container filesystem
+docker export myapp > myapp-fs.tar
+```
+
+### Health Checks
+
+```dockerfile
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+  CMD curl -f http://localhost:3000/health || exit 1
+```
+
+```bash
+# Check health status
+docker inspect --format='{{.State.Health.Status}}' myapp
+```
+
+## Image Management
+
+### Tagging and Pushing
+
+```bash
+# Tag image
+docker tag myapp:latest myregistry.com/myapp:v1.0
+
+# Push to registry
+docker push myregistry.com/myapp:v1.0
+
+# Pull image
+docker pull myregistry.com/myapp:v1.0
+```
+
+### Cleanup
+
+```bash
+# Remove unused images
+docker image prune -a
+
+# Remove all unused resources
+docker system prune -a --volumes
+
+# Remove specific image
+docker rmi myapp:old
+
+# List image sizes
+docker images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"
+```
+
+### Image Analysis
+
+```bash
+# View image history
+docker history myapp:latest
+
+# Inspect image layers
+docker inspect myapp:latest
+
+# Check image vulnerabilities (with Docker Scout)
+docker scout cves myapp:latest
+```
+
+## Docker Compose Integration
+
+```yaml
+# docker-compose.yml
+version: '3.8'
+
+services:
+  app:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    ports:
+      - "3000:3000"
+    environment:
+      - NODE_ENV=production
+    volumes:
+      - app-data:/app/data
+    depends_on:
+      - db
+    restart: unless-stopped
+
+  db:
+    image: postgres:15-alpine
+    environment:
+      POSTGRES_PASSWORD: secret
+    volumes:
+      - db-data:/var/lib/postgresql/data
+
+volumes:
+  app-data:
+  db-data:
+```
+
+## Security Best Practices
+
+### Image Security
+
+```dockerfile
+# Use specific version tags
+FROM node:20.10-alpine3.18
+
+# Don't run as root
+USER nobody
+
+# Remove unnecessary packages
+RUN apk del --purge build-dependencies
+
+# Use COPY instead of ADD
+COPY . .
+```
+
+### Runtime Security
+
+```bash
+# Run with security options
+docker run -d \
+  --security-opt=no-new-privileges \
+  --cap-drop=ALL \
+  --cap-add=NET_BIND_SERVICE \
+  --read-only \
+  myapp:latest
+
+# Use user namespace remapping
+# Add to /etc/docker/daemon.json: {"userns-remap": "default"}
+```
+
+## Common Issues
+
+### Issue: Container Exits Immediately
+**Problem**: Container starts and stops instantly
+**Solution**: Check if CMD/ENTRYPOINT runs foreground process, use `docker logs` to see errors
+
+### Issue: Cannot Connect to Container
+**Problem**: Port not accessible
+**Solution**: Verify port mapping (-p), check container is running, verify firewall rules
+
+### Issue: Out of Disk Space
+**Problem**: Docker using too much disk
+**Solution**: Run `docker system prune -a --volumes`, check for large unused images
+
+### Issue: Build Cache Not Working
+**Problem**: Every build downloads dependencies
+**Solution**: Order Dockerfile instructions from least to most frequently changing
+
+## Best Practices
+
+- Use multi-stage builds to minimize image size
+- Never store secrets in images - use runtime injection
+- Pin base image versions for reproducibility
+- Implement health checks for production containers
+- Use .dockerignore to exclude unnecessary files
+- Run containers as non-root users
+- Scan images for vulnerabilities regularly
+- Use Docker BuildKit for faster builds
+
+## Related Skills
+
+- docker-compose (`docker-compose`) - Multi-container applications
+- container-scanning (`container-scanning`) - Security scanning
+- container-hardening (`container-hardening`) - Security hardening
+
+## Limitations
+
+- Guidance executes against real environments: confirm target, blast radius, and rollback plan before applying anything.
+- Never deploy to production without explicit approval. Docs-only import: upstream scripts and templates not bundled.
+
+### Example
+
+```bash
+git status && git diff --stat
+kubectl diff -f manifest.yaml
+```
+
+> Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.

package/bundled-skills/eas-app-stores/SKILL.md

@@ -0,0 +1,197 @@
+---
+description: Curated upstream guidance for Eas App Stores; use when the workflow matches the user goal.
+name: eas-app-stores
+version: 1.1.0
+license: MIT
+source_repo: expo/skills
+source_type: official
+source: expo
+date_added: '2026-09-21'
+risk: unknown
+---
+## When to Use
+- Use when this upstream workflow matches the user's stated goal.
+- Use when the task requires the procedures documented in this skill.
+
+# App Store Deployment
+
+> **EAS service - costs apply.** Cloud builds use EAS plan resources, and EAS services have free-tier and paid-plan limits. Apple Developer and Google Play memberships are separate. Check https://expo.dev/pricing for the requested service.
+
+This skill covers building and releasing iOS and Android apps with EAS: Expo and other React Native projects, plus existing native apps. EAS is a delivery service; native apps can use it without adding Expo or React Native to their runtime. The native setup walkthrough currently covers SwiftUI/UIKit on iOS.
+
+## Choose the project path
+
+- **SwiftUI/UIKit app with no React Native runtime:** read [references/native-ios.md] before changing its build configuration. Keep the Xcode project and Swift code as the app's source of truth. The Expo/React Native quick-start and development-client examples below do not apply to this path.
+- **Native Android app with no React Native runtime:** preserve its existing native build setup. See [references/play-store.md] for submission; the Swift/iOS setup instructions do not apply. A dedicated native Android setup walkthrough is not yet included.
+- **Expo/React Native app:** use the quick-start below, then the relevant store reference.
+- **Adding React Native screens to an existing native app:** use `expo-brownfield` for that integration; return here for distribution.
+
+Use the archive and icon checks in [references/native-ios.md] during initial native iOS setup, after changing versioning, bundle IDs, or icons, or when diagnosing a rejected upload. Routine releases follow the EAS build/submit flow and the processing and availability checks in [references/testflight.md]. A successful EAS build or a queued submission does not establish Apple acceptance, tester access, or an App Store release.
+
+## References
+
+Consult these resources as needed:
+
+- ./references/workflows.md -- CI/CD workflows for automated store releases and PR previews
+- ./references/testflight.md -- Submitting iOS builds to TestFlight for beta testing
+- ./references/app-store-metadata.md -- Managing App Store metadata and ASO optimization
+- ./references/play-store.md -- Submitting Android builds to Google Play Store
+- ./references/ios-app-store.md -- iOS App Store submission and review process
+- ./references/native-ios.md -- Native Swift/SwiftUI/UIKit setup, versioning, and archive verification without an Expo runtime
+
+## Expo / React Native Quick Start
+
+### Install EAS CLI
+
+```bash
+npm install -g eas-cli
+eas login
+```
+
+### Initialize EAS
+
+```bash
+npx eas-cli@latest init
+```
+
+`eas init` links or creates the EAS project. Run `eas build:configure` to create build profiles in `eas.json`; preserve existing project and store identifiers when a release setup already exists.
+
+## Build Commands
+
+### Production Builds
+
+```bash
+# iOS App Store build
+npx eas-cli@latest build -p ios --profile production
+
+# Android Play Store build
+npx eas-cli@latest build -p android --profile production
+
+# Both platforms
+npx eas-cli@latest build --profile production
+```
+
+### Submit to Stores
+
+```bash
+# iOS: Build and submit to App Store Connect
+npx eas-cli@latest build -p ios --profile production --auto-submit
+
+# Android: Build and submit to Play Store
+npx eas-cli@latest build -p android --profile production --auto-submit
+
+# Expo / React Native shortcut for iOS TestFlight
+npx testflight
+```
+
+## Web & API Route Hosting
+
+Deploying an Expo website or Expo Router API routes to EAS Hosting (`npx expo export -p web` then `eas deploy`) is covered by the `eas-hosting` skill. This skill focuses on native app store releases.
+
+## EAS Configuration
+
+Example for an Expo / React Native project (native Swift profiles are in `references/native-ios.md`):
+
+```json
+{
+  "cli": {
+    "version": ">= 16.0.1",
+    "appVersionSource": "remote"
+  },
+  "build": {
+    "production": {
+      "autoIncrement": true,
+      "ios": {
+        "resourceClass": "m-medium"
+      }
+    },
+    "development": {
+      "developmentClient": true,
+      "distribution": "internal"
+    }
+  },
+  "submit": {
+    "production": {
+      "ios": {
+        "appleId": "your@email.com",
+        "ascAppId": "1234567890"
+      },
+      "android": {
+        "serviceAccountKeyPath": "./google-service-account.json",
+        "track": "internal"
+      }
+    }
+  }
+}
+```
+
+## Platform-Specific Guides
+
+### iOS
+
+- For native Swift apps, use the explicit build/submit flow in `references/native-ios.md`
+- For Expo / React Native apps, `npx testflight` provides a quick TestFlight flow
+- Configure Apple credentials via `eas credentials`
+- See ./references/testflight.md for credential setup
+- See ./references/ios-app-store.md for App Store submission
+
+### Android
+
+- Set up Google Play Console service account
+- Configure tracks: internal → closed → open → production
+- See ./references/play-store.md for detailed setup
+
+## Automated Releases
+
+EAS Workflows automate the build → submit → update pipeline for CI/CD. See ./references/workflows.md for store-release examples. To author or validate workflow YAML, use the `eas-workflows` skill - it works from the live workflow schema.
+
+## Version Management
+
+EAS manages version numbers automatically with `appVersionSource: "remote"`:
+
+```bash
+# Check current versions
+eas build:version:get
+
+# Manually set version
+eas build:version:set -p ios
+```
+
+The version-set command prompts for the value. When setting up or changing native iOS versioning, or diagnosing a duplicate build number, inspect the archived `CFBundleVersion`: the remote counter alone does not prove that Xcode used it.
+
+## Monitoring
+
+```bash
+# List recent builds
+eas build:list
+
+# Check build status
+eas build:view BUILD_ID
+
+# Inspect submissions (verified with EAS CLI 23.2.0)
+eas submit:list -p ios --json
+eas submit:view SUBMISSION_ID --json
+```
+
+Check the CLI version before interpreting a missing command: these submission commands are available in 23.2.0 but not in the tested 18.6.0 installation. A pinned `npx eas-cli@23.2.0` invocation can use them without changing the global installation. See `references/testflight.md` for live Apple status and retry guidance. Follow the returned log URLs when the JSON result omits the underlying failure. Report the exact build ID/version and the furthest verified release state.
+
+## Submitting Feedback
+If you encounter errors, misleading or outdated information in this skill, report it so Expo can improve:
+```bash
+npx --yes submit-expo-feedback@latest --category skills --subject "eas-app-stores" "<actionable feedback>"
+```
+Only submit when you have something specific and actionable to report. Include as much relevant context as possible.
+If an AI agent repeatedly failed or the user had to take over an Expo task, load the expo-skill-feedback skill and follow its eval-candidate flow instead of reusing the command above.
+
+
+## Examples
+
+```text
+User: Apply this skill to my current task.
+Assistant: Follow the workflow in this skill, cite limitations, and ask before risky steps.
+```
+
+## Limitations
+
+- Imported upstream skill; verify credentials, permissions, and safety boundaries before execution.
+- Does not replace environment-specific validation, testing, or maintainer review.

package/bundled-skills/eas-app-stores/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "EAS App Stores"
+  short_description: "Paid EAS service. Build and submit iOS and Android apps."
+  default_prompt: "Use $eas-app-stores to set up or verify EAS builds, TestFlight and store submissions, signing, versioning, and store metadata for iOS and Android apps: Expo and other React Native projects, plus existing native apps."