diff --git a/skills/cat-deps-actions/SKILL.md b/skills/cat-deps-actions/SKILL.md new file mode 100644 index 0000000..86ffca1 --- /dev/null +++ b/skills/cat-deps-actions/SKILL.md @@ -0,0 +1,34 @@ +--- +name: cat-deps-actions +description: Use when pinning or upgrading GitHub Actions in CAT workflows. Covers action version pins, permissions blocks, and Dependabot github-actions ecosystem. Trigger phrases include Actions pin, workflow dependencies, actions/checkout version, Dependabot github-actions. +metadata: + version: "0.1.0" + status: active + owner: Coastal Alpine Tech + last_updated: "2026-08-22" + side_effect_class: local-write + min_hitl_level: L1 + network_posture: none + resource_envelope: light + sovereignty_notes: Workflow changes can break estate CI; validate YAML before push +--- + +# CAT Deps — GitHub Actions + +## When to use + +- Bumping actions/checkout, setup-python, setup-node, etc. +- Adding Dependabot for github-actions +- Fixing missing permissions blocks + +## Standards + +1. Pin actions appropriately for sensitivity of the workflow. +2. Every workflow declares **permissions:** (default contents: read) — see `build-ci-hygiene`. +3. After workflow edits: YAML must parse; prefer green CI on a PR before merge. +4. Do not grant write permissions on PR CI unless required and justified. +5. Bulk action bumps: scoped PRs + `cat-lint-safe-edit` discipline. + +## Related + +- `cat-deps`, `build-ci-hygiene`, `ci-failure-triage`, `repo-recovery-sweep`, `branch-protection-rollout` diff --git a/skills/cat-deps-node/SKILL.md b/skills/cat-deps-node/SKILL.md new file mode 100644 index 0000000..374d0d4 --- /dev/null +++ b/skills/cat-deps-node/SKILL.md @@ -0,0 +1,44 @@ +--- +name: cat-deps-node +description: Use when auditing, pinning, or upgrading Node/npm dependencies in CAT TypeScript hubs (Front_Line_Whanau, CAT-mail, scaffylads). Covers package.json, lockfiles, npm audit, and Dependabot npm. Trigger phrases include npm audit, package.json deps, Node dependencies, Next.js dependencies. +metadata: + version: "0.1.0" + status: active + owner: Coastal Alpine Tech + last_updated: "2026-08-22" + side_effect_class: local-write + min_hitl_level: L1 + network_posture: explicit-only + resource_envelope: light + sovereignty_notes: No analytics SDKs without opt-in labelled path +--- + +# CAT Deps — Node + +## When to use + +- package.json changes on TS/Next repos +- npm audit / GHSA on JS ecosystem +- Lockfile conflicts after merges + +## Standards + +1. **Commit the lockfile**. +2. CI installs with **frozen lockfile** where supported (`npm ci`). +3. Run **npm audit** on non-trivial upgrades; document accepted risks. +4. After dep change: eslint + typecheck + **build** with placeholder env (`build-ci-hygiene`). +5. Prefer dependencies that do not phone-home by default; label any telemetry. + +## Upgrade sequence + +```text +1. Branch cat/deps- +2. Bump + refresh lockfile +3. npm ci && npm audit +4. lint + tsc + build +5. PR via cat-pr-ship +``` + +## Related + +- `cat-deps`, `cat-code-quality`, `build-ci-hygiene`, `hub-nextjs-component` diff --git a/skills/cat-deps-python/SKILL.md b/skills/cat-deps-python/SKILL.md new file mode 100644 index 0000000..ee7d743 --- /dev/null +++ b/skills/cat-deps-python/SKILL.md @@ -0,0 +1,46 @@ +--- +name: cat-deps-python +description: Use when auditing, pinning, or upgrading Python dependencies in CAT edge repos (Core, Weaver, stack, portals, harness). Covers pyproject.toml, requirements*.txt, uv/pip, pip-audit, and Dependabot pip. Trigger phrases include pip-audit, pyproject deps, Python dependencies, requirements upgrade. +metadata: + version: "0.1.0" + status: active + owner: Coastal Alpine Tech + last_updated: "2026-08-22" + side_effect_class: local-write + min_hitl_level: L1 + network_posture: explicit-only + resource_envelope: light + sovereignty_notes: Prefer deps that work offline; document any telemetry SDK +--- + +# CAT Deps — Python + +## When to use + +- Adding or upgrading a Python package on the edge stack +- pip-audit / safety findings +- Aligning pyproject vs requirements files + +## Standards + +1. Prefer **pyproject.toml** as source of truth when the repo already has it. +2. Production/runtime deps stay **minimal** for edge/RPi targets. +3. Dev deps in optional extras (`[dev]`, `[test]`). +4. Run **pip-audit** (or estate SecOps equivalent) before merging non-trivial upgrades. +5. After dep change: ruff + pytest on touched area (`cat-code-quality`). +6. Do not add cloud-only SDKs to core edge paths without explicit profile flag. + +## Upgrade sequence + +```text +1. Branch cat/deps-- +2. Bump pin +3. Install from lock/requirements +4. pip-audit +5. lint + tests +6. PR via cat-pr-ship +``` + +## Related + +- `cat-deps`, `cat-code-quality`, `build-ci-hygiene`, `secops-ci-estate-scan` diff --git a/skills/cat-deps/SKILL.md b/skills/cat-deps/SKILL.md new file mode 100644 index 0000000..c16c543 --- /dev/null +++ b/skills/cat-deps/SKILL.md @@ -0,0 +1,69 @@ +--- +name: cat-deps +description: Meta skill for Coastal Alpine Tech dependency policy. Use when deciding how to audit, pin, upgrade, or Dependabot-cover Python, Node, or GitHub Actions deps across the estate. Routes to cat-deps-python, cat-deps-node, cat-deps-actions. Trigger phrases include dependencies, Dependabot, dep policy, upgrade policy, dependency family. +metadata: + version: "0.1.0" + status: active + owner: Coastal Alpine Tech + last_updated: "2026-08-22" + side_effect_class: read-only + min_hitl_level: L1 + network_posture: explicit-only + resource_envelope: light + sovereignty_notes: Policy only; upgrades that change production behaviour need L2 +--- + +# CAT Deps (meta) + +Orchestrates dependency hygiene for the Kiwi Edge estate. + +## When to use + +- "What is our dep policy?" +- Planning Dependabot or audit coverage +- Choosing which specialist skill to load for a repo +- Before multi-repo version bumps + +## Family map + +| Skill | Surface | +|-------|--------| +| `cat-deps-python` | pip / uv / pyproject / requirements, pip-audit | +| `cat-deps-node` | npm / pnpm, package-lock, npm audit | +| `cat-deps-actions` | GitHub Actions action pins, workflow perms | +| `secops-ci-estate-scan` | Estate-wide audit report (read-only) | +| `build-ci-hygiene` | Dependabot present + least-privilege CI | +| `release-preflight` | Before publishing tags with new deps | + +## Estate policy (defaults) + +1. **Pin for reproducibility** — lockfiles committed where the ecosystem expects them. +2. **Dependabot on by default** for `pip`, `npm`, and `github-actions` ecosystems present in the repo. +3. **Prefer minor/patch auto-PRs**; **major bumps are HITL L2** with changelog skim. +4. **No silent major upgrades** on Core / Weaver / portals without tests green. +5. **Security advisories** — critical/high: triage within sprint cadence; do not ignore GHSA without written deferral. +6. **Local-first** — avoid new runtime deps that force cloud phone-home without explicit justification. + +## Routing + +```text +Python edge repo → cat-deps-python +TS / Next hub → cat-deps-node +Workflow-only change → cat-deps-actions +Whole-org scan → secops-ci-estate-scan +PR ship → cat-pr-ship + cat-code-quality +``` + +## Maturity + +| Tier | Dep expectation | +|------|-----------------| +| Gold | Lockfiles or pins; known install path | +| Diamond | Dependabot + CI install from lockfile; Actions pinned | +| Platinum | Audit in SecOps cadence; majors gated | +| Platinum Edge | Lean dep trees; edge images stay small | + +## HITL + +- Major version bumps across shared Core: L2 +- Adding a dependency with network side effects: L2 + sovereignty note