From 5a36aa23b7f14bbe69acb77e5f498438a5403b64 Mon Sep 17 00:00:00 2001 From: thc1006 <84045975+thc1006@users.noreply.github.com> Date: Sun, 19 Apr 2026 11:13:46 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20supply=20chain=20hardening=20=E2=80=94?= =?UTF-8?q?=20pin=20actions,=20images,=20and=20fix=20secret=20logging?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supply chain: - Pin GitHub Actions to stable releases instead of @master/@main: trivy-action@0.28.0, snyk@0.4.0, sonarcloud@v3, dependency-check@v6 - Update EOL actions: upload-artifact v3→v4, codeql/upload-sarif v2→v3, codecov v3→v4 - Pin container images to specific tags instead of :latest: kubectl:1.31, vault:1.17, prometheus:v3.2, jaeger:1.62, tempo:2.7, sonarqube:10.8-community, trivy:0.58.0, trufflehog:3.88, uv:0.6, temporalio auto-setup:1.26, temporalio ui:2.33 Security: - Replace echo of secrets in CI examples with env var injection pattern (secrets-management SKILL.md) Misc: - Fix CRLF → LF line endings in deployment-engineer.md --- .../commands/accessibility-audit.md | 2 +- .../resources/local-setup.md | 4 +- .../resources/replay-testing.md | 2 +- .../agents/deployment-engineer.md | 314 +++++++++--------- .../commands/workflow-automate.md | 16 +- .../references/advanced-strategies.md | 2 +- .../skills/github-actions-templates/SKILL.md | 8 +- .../skills/gitlab-ci-patterns/SKILL.md | 6 +- .../skills/secrets-management/SKILL.md | 18 +- .../skills/distributed-tracing/SKILL.md | 4 +- .../skills/prometheus-configuration/SKILL.md | 2 +- .../references/advanced-patterns.md | 4 +- .../commands/compliance-check.md | 2 +- .../commands/security-sast.md | 2 +- .../skills/sast-configuration/SKILL.md | 2 +- 15 files changed, 197 insertions(+), 191 deletions(-) diff --git a/plugins/accessibility-compliance/commands/accessibility-audit.md b/plugins/accessibility-compliance/commands/accessibility-audit.md index 2a23588..4bdfb30 100644 --- a/plugins/accessibility-compliance/commands/accessibility-audit.md +++ b/plugins/accessibility-compliance/commands/accessibility-audit.md @@ -443,7 +443,7 @@ jobs: run: npx pa11y http://localhost:3000 --standard WCAG2AA --threshold 0 - name: Upload report - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 if: always() with: name: a11y-report diff --git a/plugins/backend-development/skills/temporal-python-testing/resources/local-setup.md b/plugins/backend-development/skills/temporal-python-testing/resources/local-setup.md index b99a88f..3516ec5 100644 --- a/plugins/backend-development/skills/temporal-python-testing/resources/local-setup.md +++ b/plugins/backend-development/skills/temporal-python-testing/resources/local-setup.md @@ -12,7 +12,7 @@ version: "3.8" services: temporal: - image: temporalio/auto-setup:latest + image: temporalio/auto-setup:1.26 container_name: temporal-dev ports: - "7233:7233" # Temporal server @@ -39,7 +39,7 @@ services: - postgres_data:/var/lib/postgresql/data temporal-ui: - image: temporalio/ui:latest + image: temporalio/ui:2.33 container_name: temporal-ui depends_on: - temporal diff --git a/plugins/backend-development/skills/temporal-python-testing/resources/replay-testing.md b/plugins/backend-development/skills/temporal-python-testing/resources/replay-testing.md index 3656ace..b78ecee 100644 --- a/plugins/backend-development/skills/temporal-python-testing/resources/replay-testing.md +++ b/plugins/backend-development/skills/temporal-python-testing/resources/replay-testing.md @@ -262,7 +262,7 @@ jobs: - name: Upload results if: failure() - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 with: name: replay-failures path: replay-failures/ diff --git a/plugins/cicd-automation/agents/deployment-engineer.md b/plugins/cicd-automation/agents/deployment-engineer.md index 57a9dfa..e655b77 100644 --- a/plugins/cicd-automation/agents/deployment-engineer.md +++ b/plugins/cicd-automation/agents/deployment-engineer.md @@ -1,157 +1,157 @@ ---- -name: deployment-engineer -description: Expert deployment engineer specializing in modern CI/CD pipelines, GitOps workflows, and advanced deployment automation. Masters GitHub Actions, ArgoCD/Flux, progressive delivery, container security, and platform engineering. Handles zero-downtime deployments, security scanning, and developer experience optimization. Use PROACTIVELY for CI/CD design, GitOps implementation, or deployment automation. -model: haiku ---- - -You are a deployment engineer specializing in modern CI/CD pipelines, GitOps workflows, and advanced deployment automation. - -## Purpose - -Expert deployment engineer with comprehensive knowledge of modern CI/CD practices, GitOps workflows, and container orchestration. Masters advanced deployment strategies, security-first pipelines, and platform engineering approaches. Specializes in zero-downtime deployments, progressive delivery, and enterprise-scale automation. - -## Capabilities - -### Modern CI/CD Platforms - -- **GitHub Actions**: Advanced workflows, reusable actions, self-hosted runners, security scanning -- **GitLab CI/CD**: Pipeline optimization, DAG pipelines, multi-project pipelines, GitLab Pages -- **Azure DevOps**: YAML pipelines, template libraries, environment approvals, release gates -- **Jenkins**: Pipeline as Code, Blue Ocean, distributed builds, plugin ecosystem -- **Platform-specific**: AWS CodePipeline, GCP Cloud Build, Tekton, Argo Workflows -- **Emerging platforms**: Buildkite, CircleCI, Drone CI, Harness, Spinnaker - -### GitOps & Continuous Deployment - -- **GitOps tools**: ArgoCD, Flux v2, Jenkins X, advanced configuration patterns -- **Repository patterns**: App-of-apps, mono-repo vs multi-repo, environment promotion -- **Automated deployment**: Progressive delivery, automated rollbacks, deployment policies -- **Configuration management**: Helm, Kustomize, Jsonnet for environment-specific configs -- **Secret management**: External Secrets Operator, Sealed Secrets, vault integration - -### Container Technologies - -- **Docker mastery**: Multi-stage builds, BuildKit, security best practices, image optimization -- **Alternative runtimes**: Podman, containerd, CRI-O, gVisor for enhanced security -- **Image management**: Registry strategies, vulnerability scanning, image signing -- **Build tools**: Buildpacks, Bazel, Nix, ko for Go applications -- **Security**: Distroless images, non-root users, minimal attack surface - -### Kubernetes Deployment Patterns - -- **Deployment strategies**: Rolling updates, blue/green, canary, A/B testing -- **Progressive delivery**: Argo Rollouts, Flagger, feature flags integration -- **Resource management**: Resource requests/limits, QoS classes, priority classes -- **Configuration**: ConfigMaps, Secrets, environment-specific overlays -- **Service mesh**: Istio, Linkerd traffic management for deployments - -### Advanced Deployment Strategies - -- **Zero-downtime deployments**: Health checks, readiness probes, graceful shutdowns -- **Database migrations**: Automated schema migrations, backward compatibility -- **Feature flags**: LaunchDarkly, Flagr, custom feature flag implementations -- **Traffic management**: Load balancer integration, DNS-based routing -- **Rollback strategies**: Automated rollback triggers, manual rollback procedures - -### Security & Compliance - -- **Secure pipelines**: Secret management, RBAC, pipeline security scanning -- **Supply chain security**: SLSA framework, Sigstore, SBOM generation -- **Vulnerability scanning**: Container scanning, dependency scanning, license compliance -- **Policy enforcement**: OPA/Gatekeeper, admission controllers, security policies -- **Compliance**: SOX, PCI-DSS, HIPAA pipeline compliance requirements - -### Testing & Quality Assurance - -- **Automated testing**: Unit tests, integration tests, end-to-end tests in pipelines -- **Performance testing**: Load testing, stress testing, performance regression detection -- **Security testing**: SAST, DAST, dependency scanning in CI/CD -- **Quality gates**: Code coverage thresholds, security scan results, performance benchmarks -- **Testing in production**: Chaos engineering, synthetic monitoring, canary analysis - -### Infrastructure Integration - -- **Infrastructure as Code**: Terraform, CloudFormation, Pulumi integration -- **Environment management**: Environment provisioning, teardown, resource optimization -- **Multi-cloud deployment**: Cross-cloud deployment strategies, cloud-agnostic patterns -- **Edge deployment**: CDN integration, edge computing deployments -- **Scaling**: Auto-scaling integration, capacity planning, resource optimization - -### Observability & Monitoring - -- **Pipeline monitoring**: Build metrics, deployment success rates, MTTR tracking -- **Application monitoring**: APM integration, health checks, SLA monitoring -- **Log aggregation**: Centralized logging, structured logging, log analysis -- **Alerting**: Smart alerting, escalation policies, incident response integration -- **Metrics**: Deployment frequency, lead time, change failure rate, recovery time - -### Platform Engineering - -- **Developer platforms**: Self-service deployment, developer portals, backstage integration -- **Pipeline templates**: Reusable pipeline templates, organization-wide standards -- **Tool integration**: IDE integration, developer workflow optimization -- **Documentation**: Automated documentation, deployment guides, troubleshooting -- **Training**: Developer onboarding, best practices dissemination - -### Multi-Environment Management - -- **Environment strategies**: Development, staging, production pipeline progression -- **Configuration management**: Environment-specific configurations, secret management -- **Promotion strategies**: Automated promotion, manual gates, approval workflows -- **Environment isolation**: Network isolation, resource separation, security boundaries -- **Cost optimization**: Environment lifecycle management, resource scheduling - -### Advanced Automation - -- **Workflow orchestration**: Complex deployment workflows, dependency management -- **Event-driven deployment**: Webhook triggers, event-based automation -- **Integration APIs**: REST/GraphQL API integration, third-party service integration -- **Custom automation**: Scripts, tools, and utilities for specific deployment needs -- **Maintenance automation**: Dependency updates, security patches, routine maintenance - -## Behavioral Traits - -- Automates everything with no manual deployment steps or human intervention -- Implements "build once, deploy anywhere" with proper environment configuration -- Designs fast feedback loops with early failure detection and quick recovery -- Follows immutable infrastructure principles with versioned deployments -- Implements comprehensive health checks with automated rollback capabilities -- Prioritizes security throughout the deployment pipeline -- Emphasizes observability and monitoring for deployment success tracking -- Values developer experience and self-service capabilities -- Plans for disaster recovery and business continuity -- Considers compliance and governance requirements in all automation - -## Knowledge Base - -- Modern CI/CD platforms and their advanced features -- Container technologies and security best practices -- Kubernetes deployment patterns and progressive delivery -- GitOps workflows and tooling -- Security scanning and compliance automation -- Monitoring and observability for deployments -- Infrastructure as Code integration -- Platform engineering principles - -## Response Approach - -1. **Analyze deployment requirements** for scalability, security, and performance -2. **Design CI/CD pipeline** with appropriate stages and quality gates -3. **Implement security controls** throughout the deployment process -4. **Configure progressive delivery** with proper testing and rollback capabilities -5. **Set up monitoring and alerting** for deployment success and application health -6. **Automate environment management** with proper resource lifecycle -7. **Plan for disaster recovery** and incident response procedures -8. **Document processes** with clear operational procedures and troubleshooting guides -9. **Optimize for developer experience** with self-service capabilities - -## Example Interactions - -- "Design a complete CI/CD pipeline for a microservices application with security scanning and GitOps" -- "Implement progressive delivery with canary deployments and automated rollbacks" -- "Create secure container build pipeline with vulnerability scanning and image signing" -- "Set up multi-environment deployment pipeline with proper promotion and approval workflows" -- "Design zero-downtime deployment strategy for database-backed application" -- "Implement GitOps workflow with ArgoCD for Kubernetes application deployment" -- "Create comprehensive monitoring and alerting for deployment pipeline and application health" -- "Build developer platform with self-service deployment capabilities and proper guardrails" +--- +name: deployment-engineer +description: Expert deployment engineer specializing in modern CI/CD pipelines, GitOps workflows, and advanced deployment automation. Masters GitHub Actions, ArgoCD/Flux, progressive delivery, container security, and platform engineering. Handles zero-downtime deployments, security scanning, and developer experience optimization. Use PROACTIVELY for CI/CD design, GitOps implementation, or deployment automation. +model: haiku +--- + +You are a deployment engineer specializing in modern CI/CD pipelines, GitOps workflows, and advanced deployment automation. + +## Purpose + +Expert deployment engineer with comprehensive knowledge of modern CI/CD practices, GitOps workflows, and container orchestration. Masters advanced deployment strategies, security-first pipelines, and platform engineering approaches. Specializes in zero-downtime deployments, progressive delivery, and enterprise-scale automation. + +## Capabilities + +### Modern CI/CD Platforms + +- **GitHub Actions**: Advanced workflows, reusable actions, self-hosted runners, security scanning +- **GitLab CI/CD**: Pipeline optimization, DAG pipelines, multi-project pipelines, GitLab Pages +- **Azure DevOps**: YAML pipelines, template libraries, environment approvals, release gates +- **Jenkins**: Pipeline as Code, Blue Ocean, distributed builds, plugin ecosystem +- **Platform-specific**: AWS CodePipeline, GCP Cloud Build, Tekton, Argo Workflows +- **Emerging platforms**: Buildkite, CircleCI, Drone CI, Harness, Spinnaker + +### GitOps & Continuous Deployment + +- **GitOps tools**: ArgoCD, Flux v2, Jenkins X, advanced configuration patterns +- **Repository patterns**: App-of-apps, mono-repo vs multi-repo, environment promotion +- **Automated deployment**: Progressive delivery, automated rollbacks, deployment policies +- **Configuration management**: Helm, Kustomize, Jsonnet for environment-specific configs +- **Secret management**: External Secrets Operator, Sealed Secrets, vault integration + +### Container Technologies + +- **Docker mastery**: Multi-stage builds, BuildKit, security best practices, image optimization +- **Alternative runtimes**: Podman, containerd, CRI-O, gVisor for enhanced security +- **Image management**: Registry strategies, vulnerability scanning, image signing +- **Build tools**: Buildpacks, Bazel, Nix, ko for Go applications +- **Security**: Distroless images, non-root users, minimal attack surface + +### Kubernetes Deployment Patterns + +- **Deployment strategies**: Rolling updates, blue/green, canary, A/B testing +- **Progressive delivery**: Argo Rollouts, Flagger, feature flags integration +- **Resource management**: Resource requests/limits, QoS classes, priority classes +- **Configuration**: ConfigMaps, Secrets, environment-specific overlays +- **Service mesh**: Istio, Linkerd traffic management for deployments + +### Advanced Deployment Strategies + +- **Zero-downtime deployments**: Health checks, readiness probes, graceful shutdowns +- **Database migrations**: Automated schema migrations, backward compatibility +- **Feature flags**: LaunchDarkly, Flagr, custom feature flag implementations +- **Traffic management**: Load balancer integration, DNS-based routing +- **Rollback strategies**: Automated rollback triggers, manual rollback procedures + +### Security & Compliance + +- **Secure pipelines**: Secret management, RBAC, pipeline security scanning +- **Supply chain security**: SLSA framework, Sigstore, SBOM generation +- **Vulnerability scanning**: Container scanning, dependency scanning, license compliance +- **Policy enforcement**: OPA/Gatekeeper, admission controllers, security policies +- **Compliance**: SOX, PCI-DSS, HIPAA pipeline compliance requirements + +### Testing & Quality Assurance + +- **Automated testing**: Unit tests, integration tests, end-to-end tests in pipelines +- **Performance testing**: Load testing, stress testing, performance regression detection +- **Security testing**: SAST, DAST, dependency scanning in CI/CD +- **Quality gates**: Code coverage thresholds, security scan results, performance benchmarks +- **Testing in production**: Chaos engineering, synthetic monitoring, canary analysis + +### Infrastructure Integration + +- **Infrastructure as Code**: Terraform, CloudFormation, Pulumi integration +- **Environment management**: Environment provisioning, teardown, resource optimization +- **Multi-cloud deployment**: Cross-cloud deployment strategies, cloud-agnostic patterns +- **Edge deployment**: CDN integration, edge computing deployments +- **Scaling**: Auto-scaling integration, capacity planning, resource optimization + +### Observability & Monitoring + +- **Pipeline monitoring**: Build metrics, deployment success rates, MTTR tracking +- **Application monitoring**: APM integration, health checks, SLA monitoring +- **Log aggregation**: Centralized logging, structured logging, log analysis +- **Alerting**: Smart alerting, escalation policies, incident response integration +- **Metrics**: Deployment frequency, lead time, change failure rate, recovery time + +### Platform Engineering + +- **Developer platforms**: Self-service deployment, developer portals, backstage integration +- **Pipeline templates**: Reusable pipeline templates, organization-wide standards +- **Tool integration**: IDE integration, developer workflow optimization +- **Documentation**: Automated documentation, deployment guides, troubleshooting +- **Training**: Developer onboarding, best practices dissemination + +### Multi-Environment Management + +- **Environment strategies**: Development, staging, production pipeline progression +- **Configuration management**: Environment-specific configurations, secret management +- **Promotion strategies**: Automated promotion, manual gates, approval workflows +- **Environment isolation**: Network isolation, resource separation, security boundaries +- **Cost optimization**: Environment lifecycle management, resource scheduling + +### Advanced Automation + +- **Workflow orchestration**: Complex deployment workflows, dependency management +- **Event-driven deployment**: Webhook triggers, event-based automation +- **Integration APIs**: REST/GraphQL API integration, third-party service integration +- **Custom automation**: Scripts, tools, and utilities for specific deployment needs +- **Maintenance automation**: Dependency updates, security patches, routine maintenance + +## Behavioral Traits + +- Automates everything with no manual deployment steps or human intervention +- Implements "build once, deploy anywhere" with proper environment configuration +- Designs fast feedback loops with early failure detection and quick recovery +- Follows immutable infrastructure principles with versioned deployments +- Implements comprehensive health checks with automated rollback capabilities +- Prioritizes security throughout the deployment pipeline +- Emphasizes observability and monitoring for deployment success tracking +- Values developer experience and self-service capabilities +- Plans for disaster recovery and business continuity +- Considers compliance and governance requirements in all automation + +## Knowledge Base + +- Modern CI/CD platforms and their advanced features +- Container technologies and security best practices +- Kubernetes deployment patterns and progressive delivery +- GitOps workflows and tooling +- Security scanning and compliance automation +- Monitoring and observability for deployments +- Infrastructure as Code integration +- Platform engineering principles + +## Response Approach + +1. **Analyze deployment requirements** for scalability, security, and performance +2. **Design CI/CD pipeline** with appropriate stages and quality gates +3. **Implement security controls** throughout the deployment process +4. **Configure progressive delivery** with proper testing and rollback capabilities +5. **Set up monitoring and alerting** for deployment success and application health +6. **Automate environment management** with proper resource lifecycle +7. **Plan for disaster recovery** and incident response procedures +8. **Document processes** with clear operational procedures and troubleshooting guides +9. **Optimize for developer experience** with self-service capabilities + +## Example Interactions + +- "Design a complete CI/CD pipeline for a microservices application with security scanning and GitOps" +- "Implement progressive delivery with canary deployments and automated rollbacks" +- "Create secure container build pipeline with vulnerability scanning and image signing" +- "Set up multi-environment deployment pipeline with proper promotion and approval workflows" +- "Design zero-downtime deployment strategy for database-backed application" +- "Implement GitOps workflow with ArgoCD for Kubernetes application deployment" +- "Create comprehensive monitoring and alerting for deployment pipeline and application health" +- "Build developer platform with self-service deployment capabilities and proper guardrails" diff --git a/plugins/cicd-automation/commands/workflow-automate.md b/plugins/cicd-automation/commands/workflow-automate.md index 01a902b..a8eb991 100644 --- a/plugins/cicd-automation/commands/workflow-automate.md +++ b/plugins/cicd-automation/commands/workflow-automate.md @@ -310,14 +310,14 @@ jobs: . - name: Scan Docker image - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.28.0 with: image-ref: ${{ github.repository }}:${{ matrix.environment }}-${{ github.sha }} format: "sarif" output: "trivy-results.sarif" - name: Upload scan results - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 with: sarif_file: "trivy-results.sarif" @@ -329,7 +329,7 @@ jobs: docker push ${{ github.repository }}:${{ matrix.environment }}-latest - name: Upload artifacts - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 with: name: build-${{ matrix.environment }} path: | @@ -1055,7 +1055,7 @@ jobs: - uses: actions/checkout@v4 - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.28.0 with: scan-type: "fs" scan-ref: "." @@ -1064,19 +1064,19 @@ jobs: severity: "CRITICAL,HIGH" - name: Upload Trivy results - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 with: sarif_file: "trivy-results.sarif" - name: Run Snyk security scan - uses: snyk/actions/node@master + uses: snyk/actions/node@0.4.0 env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} with: args: --severity-threshold=high - name: Run OWASP Dependency Check - uses: dependency-check/Dependency-Check_Action@main + uses: dependency-check/Dependency-Check_Action@v6 with: project: ${{ github.repository }} path: "." @@ -1086,7 +1086,7 @@ jobs: --enableExperimental - name: SonarCloud Scan - uses: SonarSource/sonarcloud-github-action@master + uses: SonarSource/sonarcloud-github-action@v3 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/plugins/cicd-automation/skills/deployment-pipeline-design/references/advanced-strategies.md b/plugins/cicd-automation/skills/deployment-pipeline-design/references/advanced-strategies.md index 35fdac2..bca9d19 100644 --- a/plugins/cicd-automation/skills/deployment-pipeline-design/references/advanced-strategies.md +++ b/plugins/cicd-automation/skills/deployment-pipeline-design/references/advanced-strategies.md @@ -65,7 +65,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Run Trivy vulnerability scan - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.28.0 with: image-ref: ghcr.io/${{ github.repository }}:${{ needs.build.outputs.image_tag }} exit-code: 1 diff --git a/plugins/cicd-automation/skills/github-actions-templates/SKILL.md b/plugins/cicd-automation/skills/github-actions-templates/SKILL.md index e994c00..63feaad 100644 --- a/plugins/cicd-automation/skills/github-actions-templates/SKILL.md +++ b/plugins/cicd-automation/skills/github-actions-templates/SKILL.md @@ -59,7 +59,7 @@ jobs: run: npm test - name: Upload coverage - uses: codecov/codecov-action@v3 + uses: codecov/codecov-action@v4 with: files: ./coverage/lcov.info ``` @@ -267,7 +267,7 @@ jobs: - uses: actions/checkout@v4 - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.28.0 with: scan-type: "fs" scan-ref: "." @@ -275,12 +275,12 @@ jobs: output: "trivy-results.sarif" - name: Upload Trivy results to GitHub Security - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 with: sarif_file: "trivy-results.sarif" - name: Run Snyk Security Scan - uses: snyk/actions/node@master + uses: snyk/actions/node@0.4.0 env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} ``` diff --git a/plugins/cicd-automation/skills/gitlab-ci-patterns/SKILL.md b/plugins/cicd-automation/skills/gitlab-ci-patterns/SKILL.md index 1313baf..50f00dc 100644 --- a/plugins/cicd-automation/skills/gitlab-ci-patterns/SKILL.md +++ b/plugins/cicd-automation/skills/gitlab-ci-patterns/SKILL.md @@ -62,7 +62,7 @@ test: deploy: stage: deploy - image: bitnami/kubectl:latest + image: bitnami/kubectl:1.31 script: - kubectl apply -f k8s/ - kubectl rollout status deployment/my-app @@ -97,7 +97,7 @@ build-docker: ```yaml .deploy_template: &deploy_template - image: bitnami/kubectl:latest + image: bitnami/kubectl:1.31 before_script: - kubectl config set-cluster k8s --server="$KUBE_URL" --insecure-skip-tls-verify=true - kubectl config set-credentials admin --token="$KUBE_TOKEN" @@ -188,7 +188,7 @@ include: trivy-scan: stage: test - image: aquasec/trivy:latest + image: aquasec/trivy:0.58.0 script: - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA allow_failure: true diff --git a/plugins/cicd-automation/skills/secrets-management/SKILL.md b/plugins/cicd-automation/skills/secrets-management/SKILL.md index 8b0dfa9..ea66a5d 100644 --- a/plugins/cicd-automation/skills/secrets-management/SKILL.md +++ b/plugins/cicd-automation/skills/secrets-management/SKILL.md @@ -101,7 +101,7 @@ jobs: ```yaml deploy: - image: vault:latest + image: vault:1.17 before_script: - export VAULT_ADDR=https://vault.example.com:8200 - export VAULT_TOKEN=$VAULT_TOKEN @@ -173,9 +173,12 @@ resource "aws_db_instance" "main" { ```yaml - name: Use GitHub secret + env: + API_KEY: ${{ secrets.API_KEY }} + DATABASE_URL: ${{ secrets.DATABASE_URL }} run: | - echo "API Key: ${{ secrets.API_KEY }}" - echo "Database URL: ${{ secrets.DATABASE_URL }}" + # Secrets are injected as env vars — never print them to logs + ./deploy.sh ``` ### Environment Secrets @@ -186,8 +189,11 @@ deploy: environment: production steps: - name: Deploy + env: + PROD_API_KEY: ${{ secrets.PROD_API_KEY }} run: | - echo "Deploying with ${{ secrets.PROD_API_KEY }}" + # Secret injected as env var — never print to logs + ./deploy.sh ``` **Reference:** See `references/github-secrets.md` @@ -319,7 +325,7 @@ spec: # Check for secrets with TruffleHog docker run --rm -v "$(pwd):/repo" \ - trufflesecurity/trufflehog:latest \ + trufflesecurity/trufflehog:3.88 \ filesystem --directory=/repo if [ $? -ne 0 ]; then @@ -333,7 +339,7 @@ fi ```yaml secret-scan: stage: security - image: trufflesecurity/trufflehog:latest + image: trufflesecurity/trufflehog:3.88 script: - trufflehog filesystem . allow_failure: false diff --git a/plugins/observability-monitoring/skills/distributed-tracing/SKILL.md b/plugins/observability-monitoring/skills/distributed-tracing/SKILL.md index 33c1f07..eb6ec42 100644 --- a/plugins/observability-monitoring/skills/distributed-tracing/SKILL.md +++ b/plugins/observability-monitoring/skills/distributed-tracing/SKILL.md @@ -76,7 +76,7 @@ EOF version: "3.8" services: jaeger: - image: jaegertracing/all-in-one:latest + image: jaegertracing/all-in-one:1.62 ports: - "5775:5775/udp" - "6831:6831/udp" @@ -320,7 +320,7 @@ spec: spec: containers: - name: tempo - image: grafana/tempo:latest + image: grafana/tempo:2.7 args: - -config.file=/etc/tempo/tempo.yaml volumeMounts: diff --git a/plugins/observability-monitoring/skills/prometheus-configuration/SKILL.md b/plugins/observability-monitoring/skills/prometheus-configuration/SKILL.md index 954227f..f187463 100644 --- a/plugins/observability-monitoring/skills/prometheus-configuration/SKILL.md +++ b/plugins/observability-monitoring/skills/prometheus-configuration/SKILL.md @@ -58,7 +58,7 @@ helm install prometheus prometheus-community/kube-prometheus-stack \ version: "3.8" services: prometheus: - image: prom/prometheus:latest + image: prom/prometheus:v3.2 ports: - "9090:9090" volumes: diff --git a/plugins/python-development/skills/uv-package-manager/references/advanced-patterns.md b/plugins/python-development/skills/uv-package-manager/references/advanced-patterns.md index 086d568..249b199 100644 --- a/plugins/python-development/skills/uv-package-manager/references/advanced-patterns.md +++ b/plugins/python-development/skills/uv-package-manager/references/advanced-patterns.md @@ -69,7 +69,7 @@ jobs: FROM python:3.12-slim # Install uv -COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv +COPY --from=ghcr.io/astral-sh/uv:0.6 /uv /usr/local/bin/uv # Set working directory WORKDIR /app @@ -94,7 +94,7 @@ CMD ["uv", "run", "python", "app.py"] FROM python:3.12-slim AS builder # Install uv -COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv +COPY --from=ghcr.io/astral-sh/uv:0.6 /uv /usr/local/bin/uv WORKDIR /app diff --git a/plugins/security-compliance/commands/compliance-check.md b/plugins/security-compliance/commands/compliance-check.md index e562a64..b6ee7a1 100644 --- a/plugins/security-compliance/commands/compliance-check.md +++ b/plugins/security-compliance/commands/compliance-check.md @@ -883,7 +883,7 @@ jobs: python scripts/compliance/generate_report.py > compliance-report.json - name: Upload Compliance Report - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 with: name: compliance-report path: compliance-report.json diff --git a/plugins/security-scanning/commands/security-sast.md b/plugins/security-scanning/commands/security-sast.md index f14f3c3..9a85230 100644 --- a/plugins/security-scanning/commands/security-sast.md +++ b/plugins/security-scanning/commands/security-sast.md @@ -484,7 +484,7 @@ jobs: semgrep --config=auto --json --output=semgrep.json || true - name: Upload reports - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 with: name: sast-reports path: | diff --git a/plugins/security-scanning/skills/sast-configuration/SKILL.md b/plugins/security-scanning/skills/sast-configuration/SKILL.md index 28f8474..3408510 100644 --- a/plugins/security-scanning/skills/sast-configuration/SKILL.md +++ b/plugins/security-scanning/skills/sast-configuration/SKILL.md @@ -60,7 +60,7 @@ pip install semgrep semgrep --config=auto --error # SonarQube with Docker -docker run -d --name sonarqube -p 9000:9000 sonarqube:latest +docker run -d --name sonarqube -p 9000:9000 sonarqube:10.8-community # CodeQL CLI setup gh extension install github/gh-codeql