Oci devops rm 1.0.0

oci-and-db/cloud-native/devops-and-containers/devops/oci-devops-rm/.agents/skills/oci-devops-starter-maintainer/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: oci-devops-starter-maintainer
+description: Maintain, extend, validate, package, and functionally test the OKE DevOps Starter Resource Manager stack. Use when changing its Terraform, Resource Manager schema, OCI DevOps repositories, build or deployment pipelines, Helm charts, cluster-administration workflow, documentation, or release archive.
+---
+
+# OKE DevOps Starter Maintainer
+
+Use this Skill only from the root of the OKE DevOps Starter repository.
+
+## Start Every Task
+
+1. Read `README.md` for the product contract and documentation map.
+2. Read `AGENT.md` when it exists for local development history. Treat its environment identifiers as local context, never distributable content.
+3. Inspect the working tree and preserve unrelated user changes.
+4. Read only the references relevant to the task:
+   - Architecture, ownership, and source locations: `references/architecture.md`
+   - Invariants, security boundaries, and OCI constraints: `references/invariants.md`
+   - Local and functional verification: `references/testing.md`
+
+## Maintenance Workflow
+
+1. Trace the requested behavior from Resource Manager input through normalized locals, OCI resources, templates, seeded repository content, and documentation.
+2. Modify the true source of the generated behavior. Do not patch generated output when a Terraform template or local generates it.
+3. Preserve template ownership: OCI DevOps resources are starters, and repository seed operations must not overwrite user-owned paths.
+4. Keep changes entity-generic. Test at least two applications or components mentally whenever changing `for_each` maps, names, paths, parameters, tags, or pipeline wiring.
+5. Add or update regression tests for structural contracts and past OCI provider failures.
+6. Run `bash .agents/skills/oci-devops-starter-maintainer/scripts/validate.sh`.
+7. When packaging is requested, run `./update.sh`, inspect the archive, and confirm `.agents`, `AGENT.md`, local state, credentials, logs, and ad hoc scripts are absent.
+8. Apply or functionally test live OCI resources only when requested. Prefer focused tests after narrow changes and end-to-end tests after workflow changes.
+
+## Editing Rules
+
+- Keep Terraform authoritative for stable resource wiring and infrastructure, while preserving configured lifecycle ignores for user-customizable DevOps templates.
+- Keep `schema.yaml`, `variables.tf`, validation checks, locals, outputs, and documentation synchronized when changing an input.
+- Keep build specifications readable as macro steps; put complex shell behavior in named repository scripts.
+- Use lowercase pipeline parameters and exported variables unless an OCI-defined variable requires another form.
+- Never embed tenancy-specific OCIDs, usernames, auth tokens, secret values, or test-environment history in distributable files.
+- Do not introduce OCI resources managed through `local-exec` or OCI CLI. Existing `null_resource` use is limited to add-only Git repository seeding.
+- Do not assume pre-prod and prod are different physical clusters; the stack supports selecting the same cluster for both.
+- Do not weaken production approvals or immutable image/chart/version behavior without explicit direction.
+
+## Completion Report
+
+State which product behavior changed, which checks ran, whether an archive or stack was updated, and any live functional test or cleanup that remains.

oci-and-db/cloud-native/devops-and-containers/devops/oci-devops-rm/.agents/skills/oci-devops-starter-maintainer/agents/openai.yaml

@@ -0,0 +1,7 @@
+interface:
+  display_name: "OKE DevOps Starter Maintainer"
+  short_description: "Safely maintain and test the OCI DevOps starter"
+  default_prompt: "Use $oci-devops-starter-maintainer to make and validate this stack change safely."
+
+policy:
+  allow_implicit_invocation: true

oci-and-db/cloud-native/devops-and-containers/devops/oci-devops-rm/.agents/skills/oci-devops-starter-maintainer/references/architecture.md

@@ -0,0 +1,62 @@
+# Architecture And Source Ownership
+
+## Product Paths
+
+The stack creates two related workflows:
+
+- Developer delivery: application baselines plus independently built and released components.
+- Cluster administration: cluster tools, supplemental namespace resources, and cluster-wide baseline resources.
+
+Read `docs/architecture.md`, then use the task-specific guides linked from `README.md`.
+
+## Input To Resource Flow
+
+```text
+schema.yaml
+  -> variables.tf and checks.tf
+  -> root locals.tf
+  -> main.tf module inputs
+  -> modules/devops/locals.tf normalized entity maps
+  -> Terraform repositories, artifacts, pipelines, stages, triggers, and environments
+  -> templates/*.tpl and repos/* starter content
+```
+
+When changing an input, inspect every layer in that path. `schema.yaml` controls the Resource Manager form but does not replace Terraform validation.
+
+## Source Map
+
+| Concern | Primary source locations |
+| --- | --- |
+| Resource Manager form | `schema.yaml` |
+| Inputs and validation | `variables.tf`, `checks.tf`, `locals.tf` |
+| Root composition and outputs | `main.tf`, `outputs.tf` |
+| Entity normalization | `modules/devops/locals.tf` |
+| Repositories and seeding | `modules/devops/repositories.tf`, `modules/devops/cluster_admin_repositories.tf`, `script/seed_repo.sh` |
+| Build pipelines and triggers | `modules/devops/build_pipelines.tf`, `modules/devops/cluster_admin_build_pipelines.tf`, `modules/devops/triggers.tf` |
+| Deployment pipelines | `modules/devops/deploy_pipelines.tf`, `modules/devops/cluster_admin_deploy_pipelines.tf` |
+| Artifacts | `modules/devops/artifacts.tf`, `modules/devops/cluster_admin_artifacts.tf` |
+| Build and command specifications | `templates/*.yaml.tpl` |
+| Shared runtime scripts | `repos/pipelines/script`, `repos/cluster-admin/script` |
+| Generated starter content | `repos/generated` plus `local_file` resources |
+| Packaging | `update.sh` |
+| Stack upload helper | `script/update_orm_stack.sh` |
+| Regression tests | `tests/` |
+
+## Ownership Boundaries
+
+- Terraform creates stable OCI wiring and initial templates.
+- Release archives retain lifecycle ignores on user-customizable OCI DevOps resources.
+- Development archives remove only the exact release ownership blocks staged by `update.sh`.
+- Git seed operations are add-only. They may create missing files and directories but must preserve an existing path.
+- A custom component build-spec path receives the starter build spec only when missing and is never refreshed afterward.
+- `catalog/tools.yaml` is generated from Resource Manager cluster-tool input; cluster-specific values and manifests remain administrator-owned.
+
+Read `docs/template-ownership.md` before changing lifecycle blocks, repository seed triggers, or generated files.
+
+## Entity Model
+
+- One shared `pipelines` repository.
+- One chart repository and application baseline lifecycle per application.
+- One source, PR, build, dev deployment, and release lifecycle per globally unique component.
+- Optional shared `cluster-admin` repository and cluster-specific administration pipelines.
+- Pre-prod and prod networking, environments, and approvals remain independently configured even when both target the same cluster.

oci-and-db/cloud-native/devops-and-containers/devops/oci-devops-rm/.agents/skills/oci-devops-starter-maintainer/references/invariants.md

@@ -0,0 +1,42 @@
+# Invariants And OCI Constraints
+
+## Developer Delivery
+
+- Application and component names are configurable; components are globally unique.
+- Image paths use `<project>/<application>/<component>`.
+- Umbrella charts use `<project>/charts/<application>` and component charts add `/<component>`.
+- Main builds produce only a 7-character Git SHA image tag and deploy development.
+- Pull-request build specs are component-owned placeholders intended for language-specific tests.
+- Application baselines and component charts have independent package and deployment lifecycles.
+- Release builds promote an explicit semantic release-candidate tag without rebuilding the image.
+- Production follows staging and approval, retags the RC image to the final version, deploys it, records status, and tags the released commit.
+- Values artifacts are application/environment or cluster specific; image coordinates are pipeline parameters where required.
+
+## Cluster Administration
+
+- The feature is absent unless `enable_cluster_admin` is true.
+- Public HTTP(S) and OCI Helm chart sources are supported and mirrored to the project chart prefix.
+- Tool configuration forms a DAG through `depends_on`; orchestration, not arbitrary Terraform predecessor edges, enforces topological waves.
+- Independent tools run in parallel. Tool Helm deployments happen before the final cluster-wide baseline because baseline objects may use tool-provided CRDs.
+- Pre-prod begins without approval. Production requires approval before mutation.
+- Values artifact versions equal the full configuration commit SHA.
+- Supplemental namespaced resources may target only the configured tool namespace.
+- Removing Git files does not prune live objects. Explicit decommission pipelines uninstall tools.
+
+## OCI DevOps Constraints
+
+- Deployment pipeline parameters may omit defaults. Build pipeline parameters cannot use empty defaults reliably, so derive build context from sources, stage metadata, and limited OCI lookups.
+- Step-level environment assignments do not persist unless exported through the build specification contract; top-level build-spec environment values are available to all steps.
+- OCI Helm `set_values` become chart values. Do not treat undocumented values such as `DRY_RUN=true` as stage control unless verified against the live service.
+- Shell runners use OKE private endpoints and must use the target cluster worker subnet plus optional NSG.
+- The OCI provider may reject empty strings on update even where the UI displays a blank default. Prefer omitted/null defaults when supported.
+- Use `--stage-id` with `oci devops deploy-stage get`.
+- Avoid changing predecessor graphs and resource keys in one apply when OCI resources still reference old stages. Use a staged migration when necessary.
+
+## Security And Distribution
+
+- Vault secret OCIDs are inputs, never embedded defaults for credentials.
+- Secret values never enter Git, Terraform outputs, generated values, command specifications, or logs.
+- Package only product Terraform, intentional templates/scripts, starter repository content, tests, and customer documentation.
+- Exclude `.agents`, `AGENT.md`, `.git`, `.terraform`, state, tfvars, logs, credentials, local plans, generated archives, and private ad hoc deployment scripts.
+- Inspect `docs/security.md` when changing IAM, Vault, networking, repository authentication, image/chart sources, or Kubernetes privileges.

oci-and-db/cloud-native/devops-and-containers/devops/oci-devops-rm/.agents/skills/oci-devops-starter-maintainer/references/testing.md

@@ -0,0 +1,63 @@
+# Validation And Functional Testing
+
+## Local Validation
+
+Run the Skill validator from the repository root:
+
+```bash
+bash .agents/skills/oci-devops-starter-maintainer/scripts/validate.sh
+```
+
+It checks Terraform formatting and validation, Python regressions, shell syntax, and every generated Helm chart found in the workspace.
+
+When `schema.yaml` changes, also validate it against the current OCI Resource Manager metadata JSON Schema supplied for the project. Confirm Resource Manager dependencies, visibility, required fields, regex validation, multiline JSON controls, and defaults in the graphical form after upload.
+
+## Archive Verification
+
+After `./update.sh`, list the archive and reject it if it contains any of:
+
+```text
+.agents/
+AGENT.md
+.git/
+.terraform/
+terraform.tfstate
+*.tfvars
+*.log
+credentials or private test scripts
+```
+
+Test both packaging modes after changing lifecycle or packaging logic:
+
+```bash
+./update.sh
+STACK_DEVELOPMENT_MODE=true STACK_ZIP_PATH=/tmp/oke-devops-development.zip ./update.sh
+```
+
+Release mode must retain intended lifecycle ignores. Development mode must remove only the exact release ownership blocks and set the hidden development input.
+
+## Functional Test Selection
+
+Use the smallest test that proves the changed contract:
+
+| Change | Minimum live test |
+| --- | --- |
+| Resource Manager input or output | Upload/apply and inspect the graphical form plus outputs |
+| Repository seeding | Apply twice; customize between applies and prove preservation |
+| Component PR pipeline | Branch, PR, PR update, successful test run |
+| Component build | Main commit, SHA7 image, dev deployment |
+| Component release | RC promotion, staging, approval, prod, final image and Git tags |
+| Application chart | Package baseline, noprod deploy, approval, prod deploy |
+| Cluster tool | PR/build selection, mirror, target cluster deployment, health check |
+| Cluster DAG | Independent parallel wave plus dependent tool wave |
+| Decommission | Remove only the selected release/resources and preserve unrelated objects |
+
+## Live-Test Discipline
+
+1. Record resource IDs and commit hashes needed to correlate runs, but do not commit them to the Skill or distributable docs.
+2. Inspect build/deployment logs and resulting OCIR, Git, Helm, and Kubernetes state.
+3. When pre-prod and prod share a cluster, account for release-name and namespace collisions before testing.
+4. Use direct `kubectl` only for verification and requested cleanup, not as a substitute for proving OCI DevOps execution.
+5. Clean cluster-admin test charts and supplemental resources after successful functional tests unless the user asks to retain them.
+6. Never approve, destroy, decommission, or clean production-scoped resources without explicit authorization.
+7. Emit the configured completion notification only after the requested functional-test terminal condition is reached, and stop it immediately when requested.

oci-and-db/cloud-native/devops-and-containers/devops/oci-devops-rm/.agents/skills/oci-devops-starter-maintainer/scripts/validate.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+set -euo pipefail
+
+SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ROOT_DIR="$(cd "${SKILL_DIR}/../../.." && pwd)"
+PYTHON_BIN="${PYTHON_BIN:-python3}"
+
+cd "$ROOT_DIR"
+
+echo "Checking Terraform formatting"
+terraform fmt -check -recursive
+
+echo "Validating Terraform configuration"
+terraform validate
+
+echo "Running regression tests"
+if ! "$PYTHON_BIN" -c "import yaml" 2>/dev/null; then
+  echo "PyYAML is required by the regression tests; set PYTHON_BIN to a Python environment that provides it." >&2
+  exit 1
+fi
+"$PYTHON_BIN" -m unittest discover -s tests
+
+echo "Checking shell syntax"
+while IFS= read -r -d '' script_path; do
+  bash -n "$script_path"
+done < <(find repos/pipelines/script repos/cluster-admin/script script -type f -name '*.sh' -print0 2>/dev/null)
+
+echo "Linting generated Helm charts"
+while IFS= read -r chart_file; do
+  helm lint "$(dirname "$chart_file")"
+done < <(find repos/generated/charts -type f -name Chart.yaml -print 2>/dev/null | sort)
+
+echo "Maintainer validation succeeded"

oci-and-db/cloud-native/devops-and-containers/devops/oci-devops-rm/CHANGELOG.md

@@ -0,0 +1,59 @@
+# Changelog
+
+All notable changes to the OKE DevOps Starter are documented in this file.
+
+This project follows [Semantic Versioning](https://semver.org/).
+
+## [1.0.0] - 2026-07-10
+
+Initial public release of the OCI Resource Manager stack.
+
+### Application Delivery
+
+- Added support for multiple applications with multiple globally unique components from a concise JSON configuration.
+- Added generated OCI Code repositories, protected main branches, pull-request validation pipelines, build pipelines, deployment pipelines, artifacts, triggers, and OCIR paths for every configured application and component.
+- Added component-owned pull-request build specifications so teams can implement language-specific unit, integration, security, and quality checks.
+- Added parameterless main builds that produce multi-architecture images tagged with the immutable 7-character Git commit SHA.
+- Added automatic development deployment after a successful component build.
+- Added release-candidate promotion with `skopeo`, staging deployment, production approval, final image promotion, production deployment, Helm status reporting, and final Git tagging.
+- Separated application baseline charts from independently versioned and deployed component charts.
+- Added per-application bootstrap pipelines that initialize application namespaces and OCIR pull secrets on pre-production and production clusters.
+- Added cluster-specific application baseline values and environment-specific component values for development, staging, and production.
+
+### Cluster Administration
+
+- Added optional cluster administration behind the `enable_cluster_admin` feature flag.
+- Added a dedicated `cluster-admin` repository for cluster tool configuration, values, supplemental namespaced resources, and cluster-wide baseline manifests.
+- Added support for mirroring pinned public HTTP(S) and OCI Helm charts into OCIR.
+- Added dependency-aware tool deployment using a configurable DAG, with independent tools deployed in parallel and dependent tools deployed in topological waves.
+- Added immutable cluster values artifacts versioned by the full configuration commit SHA.
+- Added selective deployments so a merged configuration change invokes only affected cluster and tool stages.
+- Added matching pre-production and production orchestration, with approval required before production mutation.
+- Added explicit tool decommission pipelines without automatic pruning of unrelated Kubernetes resources.
+
+### Resource Manager Experience
+
+- Added a guided Resource Manager form for OCI DevOps, applications, independent pre-production and production OKE targets, IAM, logging, notifications, and optional cluster administration.
+- Added multiline, human-readable JSON defaults and validation for application/component and cluster-tool configuration.
+- Added configurable DevOps project, logging, notification topic, Generic Artifact repository, IAM resource names, and component build-spec paths.
+- Added structured application information outputs covering repositories, pipelines, environments, artifacts, OCIR paths, and suggested next actions.
+- Added support for using one OKE cluster as both pre-production and production for evaluation environments.
+
+### Template Ownership And Safety
+
+- Added release-mode lifecycle protection so teams can customize generated OCI DevOps starter resources without later Resource Manager applies overwriting those changes.
+- Added add-only Git repository seeding that preserves existing developer and administrator content.
+- Added a separate hidden development packaging mode for stack maintainers to refresh template-managed resources during functional testing.
+- Added Vault-backed OCIR pull credentials, private OKE endpoint access from configured worker subnets, optional NSGs, and scoped IAM policies.
+- Added release packaging exclusions for local state, credentials, development artifacts, maintainer agent context, and private stack update helpers.
+
+### Documentation
+
+- Added a customer quickstart and a Deploy to Oracle Cloud entry point.
+- Added separate developer and cluster-operations guides, workflows, runbooks, architecture diagrams, naming conventions, chart lifecycle documentation, security guidance, troubleshooting, responsibilities, and template-upgrade guidance.
+
+### Lifecycle Notes
+
+- Generated OCI DevOps resources are starter templates, not a continuously enforced CI/CD policy.
+- Removing an application, component, tool, or manifest from configuration does not automatically delete its Git content or live Kubernetes resources.
+- Production can target the same physical OKE cluster as pre-production for evaluation, but separate clusters are recommended for production isolation.