 thc1006
|
5a36aa23b7
|
fix: supply chain hardening — pin actions, images, and fix secret logging
Supply chain:
- Pin GitHub Actions to stable releases instead of @master/@main:
trivy-action@0.28.0, snyk@0.4.0, sonarcloud@v3, dependency-check@v6
- Update EOL actions: upload-artifact v3→v4, codeql/upload-sarif v2→v3,
codecov v3→v4
- Pin container images to specific tags instead of :latest:
kubectl:1.31, vault:1.17, prometheus:v3.2, jaeger:1.62, tempo:2.7,
sonarqube:10.8-community, trivy:0.58.0, trufflehog:3.88, uv:0.6,
temporalio auto-setup:1.26, temporalio ui:2.33
Security:
- Replace echo of secrets in CI examples with env var injection pattern
(secrets-management SKILL.md)
Misc:
- Fix CRLF → LF line endings in deployment-engineer.md
|
2026-04-19 11:13:46 +00:00 |
|
|
Seth Hobson
|
f662524f9a
|
feat: add Conductor plugin for Context-Driven Development
Add comprehensive Conductor plugin implementing Context-Driven Development
methodology with tracks, specs, and phased implementation plans.
Components:
- 5 commands: setup, new-track, implement, status, revert
- 1 agent: conductor-validator
- 3 skills: context-driven-development, track-management, workflow-patterns
- 18 templates for project artifacts
Documentation updates:
- README.md: Updated counts (68 plugins, 100 agents, 110 skills, 76 tools)
- docs/plugins.md: Added Conductor to Workflows section
- docs/agents.md: Added conductor-validator agent
- docs/agent-skills.md: Added Conductor skills section
Also includes Prettier formatting across all project files.
|
2026-01-15 17:38:21 -05:00 |
|
|
Kiri
|
ddbd034ca3
|
feat: add Temporal workflow orchestration to backend-development plugin (#125)
* docs: enhance payment-integration agent with critical security guidance
Add evidence-based security requirements from Stripe, PayPal, OWASP:
- Webhook security (signature verification, idempotency, quick response, server validation)
- PCI compliance essentials (tokenization, server-side validation, environment separation)
- Real-world failure examples (processor collapse, Lambda failures, malicious price manipulation)
Minimal expansion: 32 to 57 lines (25 lines added)
* feat: add Temporal workflow orchestration to backend-development plugin
Add comprehensive Temporal workflow orchestration support with 1 agent and 2 skills:
**Agent:**
- temporal-python-pro: Python SDK expert for durable workflows, saga patterns,
async/await patterns, error handling, and production deployment
**Skills:**
- workflow-orchestration-patterns: Language-agnostic patterns for workflows vs
activities, saga compensation, entity workflows, and determinism constraints
- temporal-python-testing: Progressive disclosure testing guide with unit testing,
integration testing, replay testing, and local development setup
**Changes:**
- Add agent: plugins/backend-development/agents/temporal-python-pro.md (311 lines)
- Add skill: plugins/backend-development/skills/workflow-orchestration-patterns/ (286 lines)
- Add skill: plugins/backend-development/skills/temporal-python-testing/ (SKILL.md + 4 resource files)
- Update marketplace.json: backend-development plugin v1.2.2 → v1.2.3
- Update docs/agents.md: 85 → 86 agents
- Update docs/agent-skills.md: 55 → 57 skills
**Content Sources:**
- Official Temporal documentation (docs.temporal.io)
- Temporal Python SDK guide (python.temporal.io)
- Temporal architecture docs (github.com/temporalio/temporal)
- OWASP best practices for distributed systems
Addresses #124
---------
Co-authored-by: Kiran Eshwarappa <kiran.eshwarapa@gmail.com>
|
2025-11-16 20:45:36 -05:00 |
|