devops-deployment

Malicious tool definition detected

Malicious tool definition detected

RUN npm run build && npm run test # Stage 3: Minimal production runtime FROM node:20-alpine AS runner WORKDIR /app RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001 COPY --from=deps --chown=nodejs:nodejs /app/node_modules ./node_modules COPY --from=builder --chown=nodejs:nodejs /app/dist ./dist COPY --chown=nodejs:nodejs package*.json ./ USER nodejs EXPOSE 3000 ENV NODE_ENV=production HEALTHCHECK --interval=30s --timeout=3s CMD node healthcheck.js || exit 1 CMD ["node", "dist/main.js"]

Malicious tool definition detected

Malicious tool definition detected

# Stage 3: Production FROM node:20-alpine@sha256:09e2b3d9726018aecf269bd35325f46bf75046a643a66d28360ec71132750ec8 AS runner WORKDIR /app # Create non-root user RUN addgroup --system --gid 1001 nodejs && \ adduser --system --uid 1001 appuser # Copy built artifacts COPY --from=deps /app/node_modules ./node_modules COPY --from=builder /app/dist ./dist COPY --from=builder /app/package.json ./ # Set ownership RUN chown -R appuser:nodejs /app USER appuser # Expose port EXPOSE 3000 # Health check HEALT

Risky tool definition detected

dockerfile: Dockerfile ports: - "${DETECTED_PORT}:${DETECTED_PORT}" # Use detected App Port above environment: - DATABASE_URL=postgresql://postgres:postgres@db:5432/$ARGUMENTS - REDIS_URL=redis://redis:6379 depends_on: db: condition: service_healthy redis: condition: service_started db: image: postgres:16-alpine environment: POSTGRES_DB: $ARGUMENTS POSTGRES_USER: postgres POSTGRES_PASSWORD: postgres ports: - "5432:5432" volumes: - postgres_data:/var/lib/postgresql/data healthcheck: test: ["CMD-

Malicious tool definition detected

## External Secrets Operator Sync secrets from cloud providers to Kubernetes: ```yaml apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: app-secrets spec: refreshInterval: 1h secretStoreRef: name: aws-secrets-manager kind: ClusterSecretStore target: name: app-secrets creationPolicy: Owner data: - secretKey: database-url remoteRef: key: prod/app/database property: url - secretKey: api-key remoteRef: key: prod/app/api-keys property: main ``` **Supported backends:** - AWS

Risky tool definition detected

user-invocable: false argument-hint: [workflow-name] --- Create CI pipeline: $ARGUMENTS ## Pipeline Context (Auto-Detected) - **Project Type**: !`grep -r "python\|node\|rust\|go" package.json pyproject.toml Cargo.toml go.mod 2>/dev/null | head -1 | grep -oE 'python|node|rust|go' || echo "Node.js"` - **Node Version**: !`grep -r '"node"' package.json .nvmrc 2>/dev/null | head -1 | grep -oE '[0-9]+' || echo "20"` - **Python Version**: !`grep -r "python_requires\|python" pyproject.toml 2>/dev/null |

Malicious tool definition detected

- **Service-specific** variables override shared ones - Reference other vars: `${{shared.DATABASE_URL}}` - Never hardcode secrets — use Railway's encrypted env vars ## Database Provisioning Railway provisions managed databases with one click: - PostgreSQL, MySQL, Redis, MongoDB - Connection string auto-injected as env var - Backups included on paid plans ## Multi-Service Setup - Use **monorepo** config: set `rootDirectory` per service - Internal networking: services communicate via `${{service.R

Malicious tool definition detected

Tool: devops-deployment/scripts/argocd-application.yaml Description: # ArgoCD Application for GitOps deployment apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: app namespace: argocd spec: project: default source: repoURL: https://github.com/org/app-config.git targetRevision: HEAD path: k8s/overlays/production destination:

Malicious tool definition detected

Tool: devops-deployment/rules/devops-branch-protection.md Description: --- title: Protect CI/CD branches from direct pushes to enforce code review and audit trails category: cicd impact: HIGH impactDescription: "Unprotected branches allow direct pushes to production — bypassing code review, CI checks, and audit trails" tags: [cicd, git, branch-protection, code-review] --- ## CI/CD: Branch Protection Configure branch protection rules to enforce code review, passing CI checks, and linear history o

Malicious tool definition detected

image: postgres:16-alpine environment: POSTGRES_USER: postgres POSTGRES_PASSWORD: postgres POSTGRES_DB: app volumes: - postgres_data:/var/lib/postgresql/data ports: - "5432:5432" healthcheck: test: ["CMD-SHELL", "pg_isready -U postgres"] interval: 5s timeout: 5s retries: 5 redis: image: redis:7-alpine ports: - "6379:6379" volumes: - redis_data:/data volumes: postgres_data: redis_data:

Malicious tool definition detected

pull_request: branches: [main, dev] paths: ['backend/**'] jobs: lint-and-test: runs-on: ubuntu-latest defaults: run: working-directory: backend steps: - uses: actions/checkout@v3 - name: Setup Python uses: actions/setup-python@v4 with: python-version: '3.11' - name: Cache Poetry Dependencies uses: actions/cache@v3 with: path: ~/.cache/pypoetry key: ${{ runner.os }}-poetry-${{ hashFiles('backend/poetry.lock') }} - name: Install Poetry run: pip install poetry - name: Install Dependencies run: poet

Malicious tool definition detected

Malicious tool definition detected

Tool: devops-deployment/scripts/external-secrets.yaml Description: # External Secrets Operator with AWS Secrets Manager apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: app-secrets spec: refreshInterval: 1h secretStoreRef: name: aws-secrets-manager kind: ClusterSecretStore

Malicious tool definition detected

## Prometheus Metrics Exposition ```python from prometheus_client import Counter, Histogram, generate_latest # Define metrics http_requests_total = Counter( 'http_requests_total', 'Total HTTP requests', ['method', 'endpoint', 'status'] ) http_request_duration_seconds = Histogram( 'http_request_duration_seconds', 'HTTP request duration', ['method', 'endpoint'] ) @app.middleware("http") async def prometheus_middleware(request: Request, call_next): start_time = time.time() response = await call_nex

Malicious tool definition detected

async def backfill_emails(): users = await db.fetch("SELECT id FROM users WHERE email IS NULL") for user in users: email = generate_email(user.id) await db.execute( "UPDATE users SET email = %s WHERE id = %s", (email, user.id), ) ``` ```sql -- Phase 3: Add constraint after backfill is verified complete ALTER TABLE users ALTER COLUMN email SET NOT NULL; ``` **Backward-compatible changes (safe to deploy directly):** - Add nullable column - Add new table - Add index - Rename column with a view alia

Tool passed security scan

Tool passed security scan

Tool passed security scan

Tool passed security scan