wicked-garden 12.27.0

package/skills/platform/github-actions/refs/security.md

@@ -0,0 +1,150 @@
+---
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+# GitHub Actions Security Reference
+
+## Permissions
+
+### Minimal Permissions Table
+
+| Task | Required Permissions |
+|------|---------------------|
+| Read code | `contents: read` |
+| Push commits | `contents: write` |
+| Create/update PRs | `pull-requests: write` |
+| Modify issues | `issues: write` |
+| Deploy to Pages | `pages: write` |
+| OIDC auth | `id-token: write` |
+| Create releases | `contents: write` |
+| Publish packages | `packages: write` |
+| Security alerts | `security-events: write` |
+
+### Permission Blocks
+
+```yaml
+# Read-only (safest)
+permissions:
+  contents: read
+
+# PR automation
+permissions:
+  contents: read
+  pull-requests: write
+
+# Deployment
+permissions:
+  contents: read
+  id-token: write  # For OIDC
+
+# Full release
+permissions:
+  contents: write
+  packages: write
+```
+
+## OIDC Authentication
+
+**Never store cloud credentials as secrets.** Use OIDC instead.
+
+### AWS
+
+```yaml
+- uses: aws-actions/configure-aws-credentials@v4
+  with:
+    role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+    aws-region: ${{ vars.AWS_REGION }}
+```
+
+### Azure
+
+```yaml
+- uses: azure/login@v2
+  with:
+    client-id: ${{ vars.AZURE_CLIENT_ID }}
+    tenant-id: ${{ vars.AZURE_TENANT_ID }}
+    subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+```
+
+### GCP
+
+```yaml
+- uses: google-github-actions/auth@v2
+  with:
+    workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY }}
+    service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
+```
+
+## Input Sanitization
+
+### Dangerous
+
+```yaml
+# Command injection possible
+run: |
+  echo "Processing: ${{ github.event.issue.title }}"
+  git commit -m "${{ github.event.pull_request.title }}"
+```
+
+### Safe
+
+```yaml
+# Use env vars to escape properly
+env:
+  ISSUE_TITLE: ${{ github.event.issue.title }}
+  PR_TITLE: ${{ github.event.pull_request.title }}
+run: |
+  echo "Processing: $ISSUE_TITLE"
+  git commit -m "$PR_TITLE"
+```
+
+## Pull Request Security
+
+### `pull_request` vs `pull_request_target`
+
+| Event | Fork Access | Secret Access | Use When |
+|-------|-------------|---------------|----------|
+| `pull_request` | Runs on fork | No secrets | CI testing |
+| `pull_request_target` | Runs on base | Has secrets | Label/comment bots |
+
+**Rule:** Only use `pull_request_target` when you need to write to the repo (labels, comments). Never checkout untrusted code with secrets access.
+
+### Safe Pattern for PR Labeling
+
+```yaml
+on:
+  pull_request_target:
+    types: [opened]
+permissions:
+  pull-requests: write
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      # Don't checkout code - just use API
+      - uses: actions/labeler@v5
+```
+
+## Action Pinning
+
+### Pin to SHA (Most Secure)
+
+```yaml
+uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+```
+
+### Find SHA
+
+```bash
+gh api repos/actions/checkout/git/refs/tags/v4.1.0 --jq '.object.sha'
+```
+
+## Self-Hosted Runner Security
+
+**Never use self-hosted runners for public repos.** Any PR can run arbitrary code.
+
+For private repos:
+- Use ephemeral runners
+- Isolate with containers
+- Limit network access
+- Rotate credentials

package/skills/platform/github-actions/refs/templates.md

@@ -0,0 +1,230 @@
+---
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+# GitHub Actions Templates
+
+Copy-paste templates with security and optimization built in.
+
+## Node.js CI
+
+```yaml
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+      - run: npm ci
+      - run: npm run lint
+      - run: npm test
+```
+
+## Python CI
+
+```yaml
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        python: ['3.10', '3.11', '3.12']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+          cache: 'pip'
+      - run: pip install -e ".[dev]"
+      - run: pytest
+```
+
+## Docker Build and Push
+
+```yaml
+name: Docker
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/build-push-action@v5
+        with:
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+```
+
+## Deploy to AWS (OIDC)
+
+```yaml
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: deploy-${{ github.ref }}
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
+          aws-region: ${{ vars.AWS_REGION }}
+
+      # Your deploy commands here
+      - run: aws s3 sync ./dist s3://${{ vars.S3_BUCKET }}
+```
+
+## Release with Changelog
+
+```yaml
+name: Release
+
+on:
+  push:
+    tags: ['v*']
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: softprops/action-gh-release@v1
+        with:
+          generate_release_notes: true
+```
+
+## Security Scanning
+
+```yaml
+name: Security
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '0 0 * * 1'  # Weekly
+
+permissions:
+  security-events: write
+  contents: read
+
+jobs:
+  codeql:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript
+
+      - uses: github/codeql-action/autobuild@v3
+
+      - uses: github/codeql-action/analyze@v3
+```
+
+## Scheduled Maintenance
+
+```yaml
+name: Maintenance
+
+on:
+  schedule:
+    - cron: '0 9 * * 1'  # Monday 9am UTC
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update-deps:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - run: |
+          npm update
+          npm audit fix
+
+      - uses: peter-evans/create-pull-request@v6
+        with:
+          title: 'chore: update dependencies'
+          branch: deps/weekly-update
+```

package/skills/platform/github-actions/refs/troubleshooting.md

@@ -0,0 +1,174 @@
+---
+phase_relevance: ["build", "review", "operate"]
+archetype_relevance: ["*"]
+---
+# GitHub Actions Troubleshooting
+
+Common errors and fixes.
+
+## Permission Errors
+
+### "Resource not accessible by integration"
+
+**Cause:** Missing permissions.
+
+**Fix:** Add explicit permissions block:
+```yaml
+permissions:
+  contents: write  # or whatever you need
+```
+
+### "GITHUB_TOKEN does not have access"
+
+**Cause:** Trying to trigger another workflow or push to protected branch.
+
+**Fix:** Use a PAT or GitHub App token:
+```yaml
+- uses: actions/checkout@v4
+  with:
+    token: ${{ secrets.PAT }}
+```
+
+## Secrets Issues
+
+### "Secret not found" in PR from fork
+
+**Cause:** Secrets aren't available to forked PRs (by design).
+
+**Fix:** Use `pull_request_target` cautiously, or skip steps:
+```yaml
+- if: github.event.pull_request.head.repo.full_name == github.repository
+  run: deploy
+```
+
+## Cache Issues
+
+### Cache not restoring
+
+**Common causes:**
+1. Key mismatch - check hash input
+2. Cache size limit (10GB per repo)
+3. 7-day expiration
+
+**Debug:**
+```yaml
+- uses: actions/cache@v4
+  with:
+    path: ~/.npm
+    key: ${{ runner.os }}-npm-${{ hashFiles('**/package-lock.json') }}
+    restore-keys: |
+      ${{ runner.os }}-npm-
+```
+
+## Workflow Triggers
+
+### Workflow not triggering
+
+**Check:**
+1. Branch name matches filter
+2. File path matches path filter
+3. No `[skip ci]` in commit message
+4. Not hitting concurrent run limits
+
+### Double triggers
+
+**Cause:** Both `push` and `pull_request` firing.
+
+**Fix:** Use conditional:
+```yaml
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+```
+
+Or filter:
+```yaml
+jobs:
+  build:
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository
+```
+
+## Timeout Issues
+
+### Job killed without error
+
+**Cause:** Hit 6-hour job limit or your timeout.
+
+**Fix:**
+```yaml
+jobs:
+  build:
+    timeout-minutes: 60  # Set explicit limit
+```
+
+### Hanging on checkout
+
+**Cause:** Large repo or LFS files.
+
+**Fix:**
+```yaml
+- uses: actions/checkout@v4
+  with:
+    fetch-depth: 1  # Shallow clone
+    lfs: false      # Skip LFS
+```
+
+## Rate Limiting
+
+### "API rate limit exceeded"
+
+**Fix:** Cache API responses or reduce calls:
+```yaml
+- uses: actions/cache@v4
+  id: api-cache
+  with:
+    path: .api-cache
+    key: api-${{ github.run_id }}
+    restore-keys: api-
+
+- if: steps.api-cache.outputs.cache-hit != 'true'
+  run: fetch-from-api
+```
+
+## Docker Issues
+
+### Build cache not working
+
+**Fix:** Use buildx with GHA cache:
+```yaml
+- uses: docker/setup-buildx-action@v3
+- uses: docker/build-push-action@v5
+  with:
+    cache-from: type=gha
+    cache-to: type=gha,mode=max
+```
+
+### Out of disk space
+
+**Fix:** Clean up before build:
+```yaml
+- run: docker system prune -af
+```
+
+## Debugging
+
+### Enable debug logging
+
+1. Set secret `ACTIONS_RUNNER_DEBUG` to `true`
+2. Re-run workflow
+
+### Print context
+
+```yaml
+- run: echo '${{ toJSON(github) }}'
+- run: env | sort
+```
+
+### SSH into runner
+
+```yaml
+- uses: mxschmitt/action-tmate@v3
+  if: failure()
+```