diff --git a/docs/README.skills.md b/docs/README.skills.md index aac5f9b55..11d763a1d 100644 --- a/docs/README.skills.md +++ b/docs/README.skills.md @@ -324,6 +324,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [refactor](../skills/refactor/SKILL.md)
`gh skills install github/awesome-copilot refactor` | Surgical code refactoring to improve maintainability without changing behavior. Covers extracting functions, renaming variables, breaking down god functions, improving type safety, eliminating code smells, and applying design patterns. Less drastic than repo-rebuilder; use for gradual improvements. | None | | [refactor-method-complexity-reduce](../skills/refactor-method-complexity-reduce/SKILL.md)
`gh skills install github/awesome-copilot refactor-method-complexity-reduce` | Refactor given method `${input:methodName}` to reduce its cognitive complexity to `${input:complexityThreshold}` or below, by extracting helper methods. | None | | [refactor-plan](../skills/refactor-plan/SKILL.md)
`gh skills install github/awesome-copilot refactor-plan` | Create a concrete plan before starting a multi-file refactor. Use when the user asks to plan, sequence, scope, or safely execute a refactor across multiple files; always investigate first, output the plan, and wait for confirmation before making code changes. | None | +| [remediation-bash-generator](../skills/remediation-bash-generator/SKILL.md)
`gh skills install github/awesome-copilot remediation-bash-generator` | Generate production-ready, idempotent Bash remediation and rollback scripts for cloud infrastructure findings. Use this skill whenever a remediation requires executable shell automation for AWS, Azure, GCP, Kubernetes, Linux, or other infrastructure resources. | None | | [remember](../skills/remember/SKILL.md)
`gh skills install github/awesome-copilot remember` | Transforms lessons learned into domain-organized memory instructions (global or workspace). Syntax: `/remember [>domain [scope]] lesson clue` where scope is `global` (default), `user`, `workspace`, or `ws`. | None | | [remember-interactive-programming](../skills/remember-interactive-programming/SKILL.md)
`gh skills install github/awesome-copilot remember-interactive-programming` | A micro-prompt that reminds the agent that it is an interactive programmer. Works great in Clojure when Copilot has access to the REPL (probably via Backseat Driver). Will work with any system that has a live REPL that the agent can use. Adapt the prompt with any specific reminders in your workflow and/or workspace. | None | | [repo-story-time](../skills/repo-story-time/SKILL.md)
`gh skills install github/awesome-copilot repo-story-time` | Generate a comprehensive repository summary and narrative story from commit history | None | diff --git a/package-lock.json b/package-lock.json index 12e29e3af..6730e73be 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,7 +9,7 @@ "version": "1.0.0", "license": "MIT", "dependencies": { - "js-yaml": "^5.2.0", + "js-yaml": "4.2.0", "vfile": "^6.0.3", "vfile-matter": "^5.0.1" }, @@ -19,9 +19,9 @@ } }, "node_modules/@babel/runtime": { - "version": "7.28.3", - "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.3.tgz", - "integrity": "sha512-9uIQ10o0WGdpP6GDhXcdOJPJuDgFtIDtN/9+ArJQ2NAfAmiuhTQdzkaTGR33v43GYS2UrSA0eX2pPPHoFVvpxA==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz", + "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==", "dev": true, "license": "MIT", "engines": { @@ -29,9 +29,9 @@ } }, "node_modules/@github/copilot": { - "version": "1.0.64-3", - "resolved": "https://registry.npmjs.org/@github/copilot/-/copilot-1.0.64-3.tgz", - "integrity": "sha512-Q9nBMYEHX1bJLXzzJocQx2nZvORJ0E9gvK6ly/FCtmtA7ad96BWZvf4EHzkCNDsn56aI3zNaUSfKHUKcmIAzSg==", + "version": "1.0.65", + "resolved": "https://registry.npmjs.org/@github/copilot/-/copilot-1.0.65.tgz", + "integrity": "sha512-J1XvLuOiVpiAi/E1MBICBymszCgdGLnZxokosXzGcmcjEVZd+QSDoW/kPRHq6oEyBT9SDASPcjCEZ9Q0rLJllg==", "dev": true, "license": "SEE LICENSE IN LICENSE.md", "dependencies": { @@ -41,20 +41,20 @@ "copilot": "npm-loader.js" }, "optionalDependencies": { - "@github/copilot-darwin-arm64": "1.0.64-3", - "@github/copilot-darwin-x64": "1.0.64-3", - "@github/copilot-linux-arm64": "1.0.64-3", - "@github/copilot-linux-x64": "1.0.64-3", - "@github/copilot-linuxmusl-arm64": "1.0.64-3", - "@github/copilot-linuxmusl-x64": "1.0.64-3", - "@github/copilot-win32-arm64": "1.0.64-3", - "@github/copilot-win32-x64": "1.0.64-3" + "@github/copilot-darwin-arm64": "1.0.65", + "@github/copilot-darwin-x64": "1.0.65", + "@github/copilot-linux-arm64": "1.0.65", + "@github/copilot-linux-x64": "1.0.65", + "@github/copilot-linuxmusl-arm64": "1.0.65", + "@github/copilot-linuxmusl-x64": "1.0.65", + "@github/copilot-win32-arm64": "1.0.65", + "@github/copilot-win32-x64": "1.0.65" } }, "node_modules/@github/copilot-darwin-arm64": { - "version": "1.0.64-3", - "resolved": "https://registry.npmjs.org/@github/copilot-darwin-arm64/-/copilot-darwin-arm64-1.0.64-3.tgz", - "integrity": "sha512-wlV6mRoAd/wG2V08TG+BOJ0nyOjroya24FSyA5A49z7PnUUuQXYRpa/GljvI5j3PM8aUl0DyBkXuB/DcFU818g==", + "version": "1.0.65", + "resolved": "https://registry.npmjs.org/@github/copilot-darwin-arm64/-/copilot-darwin-arm64-1.0.65.tgz", + "integrity": "sha512-NFc4xIstZNiIuAYkurQT5DVtbZjBoZ/z6yt/Ffcom7Y5QGjfpN4BFuekv9k+OADRioxxR99NgmhjbuNPWtQhNQ==", "cpu": [ "arm64" ], @@ -69,9 +69,9 @@ } }, "node_modules/@github/copilot-darwin-x64": { - "version": "1.0.64-3", - "resolved": "https://registry.npmjs.org/@github/copilot-darwin-x64/-/copilot-darwin-x64-1.0.64-3.tgz", - "integrity": "sha512-mk48PIESL2keeemX7tLRmWRDxKwl0q3cFI1ORD2QcrieNK7pSqI3eVbfoB7MqoUUI27yzIkl67xqgl8Qq28IUQ==", + "version": "1.0.65", + "resolved": "https://registry.npmjs.org/@github/copilot-darwin-x64/-/copilot-darwin-x64-1.0.65.tgz", + "integrity": "sha512-0wtV22KmTa12VbqWRRkgvJcBz/oIbszfcIpyDWGc4MzbCVksajQ3TWVQ6c7Sdzj5RifCaYdkHAX2zuIYXYlLoQ==", "cpu": [ "x64" ], @@ -86,9 +86,9 @@ } }, "node_modules/@github/copilot-linux-arm64": { - "version": "1.0.64-3", - "resolved": "https://registry.npmjs.org/@github/copilot-linux-arm64/-/copilot-linux-arm64-1.0.64-3.tgz", - "integrity": "sha512-rCgtK3/rofQW5StSbeU0TwDUlOl2bvS2HGKyapVxow1Nvz3Q/TDB+eFRQc5ocBdv5tNSor+Caw2JGkRx5v508w==", + "version": "1.0.65", + "resolved": "https://registry.npmjs.org/@github/copilot-linux-arm64/-/copilot-linux-arm64-1.0.65.tgz", + "integrity": "sha512-dOwdy/YbTXQN/+x2v4ZgiDycdRtWElyHxPuA6ail3yJDt0nagwn8OYAA/diBLPMAJuuBXiOZGvvb9fGRuh7Xgg==", "cpu": [ "arm64" ], @@ -103,9 +103,9 @@ } }, "node_modules/@github/copilot-linux-x64": { - "version": "1.0.64-3", - "resolved": "https://registry.npmjs.org/@github/copilot-linux-x64/-/copilot-linux-x64-1.0.64-3.tgz", - "integrity": "sha512-FAiBMw1h07mURSBLi3ztj5yzbP+uTbo9mhxOym1Xysut5LDpO2kYUzTYk2DlIyLGZhmH/HDOZE+b6U7lOUQy0g==", + "version": "1.0.65", + "resolved": "https://registry.npmjs.org/@github/copilot-linux-x64/-/copilot-linux-x64-1.0.65.tgz", + "integrity": "sha512-al/1a/l/GrpHtygTxt7PZspmv0eHBPdAZ5B31J7Hv/GRdVZM4STCC9dCIOSUFsOX2fhaKD8yLfz4HureSYs23g==", "cpu": [ "x64" ], @@ -120,9 +120,9 @@ } }, "node_modules/@github/copilot-linuxmusl-arm64": { - "version": "1.0.64-3", - "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-arm64/-/copilot-linuxmusl-arm64-1.0.64-3.tgz", - "integrity": "sha512-vn8P6grPf0y2mNskkdVbAz0i46b1sP9uSXv7z6kgycjprl0CdIYPDf3WEkG60vpyopfQna+iCqCLMWRnNyCk3g==", + "version": "1.0.65", + "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-arm64/-/copilot-linuxmusl-arm64-1.0.65.tgz", + "integrity": "sha512-xccQeJSR45xyoaL7J5mZjtU++dmte+ZCDQkIlrpTn2yuMl2LWriBvorQ1P2MwVnXmIiW/GHi93B+lNtsybA9yw==", "cpu": [ "arm64" ], @@ -137,9 +137,9 @@ } }, "node_modules/@github/copilot-linuxmusl-x64": { - "version": "1.0.64-3", - "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-x64/-/copilot-linuxmusl-x64-1.0.64-3.tgz", - "integrity": "sha512-atdHimNd6nzRRwHybXUY6/84bYzXeKbDOeYN/N/DsX23+AQOPSu5BD8MD8166I/5kNHui0XOmeTSydVNBUwcJw==", + "version": "1.0.65", + "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-x64/-/copilot-linuxmusl-x64-1.0.65.tgz", + "integrity": "sha512-RHPVUaqjSrhKHQ2EpfGKWErnV+R5elGIZaHXPKO10zpSaQD9b/C9u6nLigZnBuT/8sCaJpVrazPMwOYvYA62aw==", "cpu": [ "x64" ], @@ -154,13 +154,13 @@ } }, "node_modules/@github/copilot-sdk": { - "version": "1.0.3", - "resolved": "https://registry.npmjs.org/@github/copilot-sdk/-/copilot-sdk-1.0.3.tgz", - "integrity": "sha512-ujnH2QVw3+xvjgo9cbpY0wik4fNxAmdMDSFnxGScDSvRuK2vUCL2xWW4V2ANc9pWwRHPBpEpMuNJMtmydmLCIQ==", + "version": "1.0.4", + "resolved": "https://registry.npmjs.org/@github/copilot-sdk/-/copilot-sdk-1.0.4.tgz", + "integrity": "sha512-c6/gpatP7LAuP9stlc2uXXOrB+TJMFSs3Jrzu9FG8lJJYFGmdzbBvGz2UdL1jww84fp6D7cohEZa4UGq1+iuyA==", "dev": true, "license": "MIT", "dependencies": { - "@github/copilot": "^1.0.64-1", + "@github/copilot": "^1.0.65", "vscode-jsonrpc": "^8.2.1", "zod": "^4.3.6" }, @@ -169,9 +169,9 @@ } }, "node_modules/@github/copilot-win32-arm64": { - "version": "1.0.64-3", - "resolved": "https://registry.npmjs.org/@github/copilot-win32-arm64/-/copilot-win32-arm64-1.0.64-3.tgz", - "integrity": "sha512-jUTS9meoHEXQR8nMDOjwC0baqV273lYtLxY46W7TiOFszhsqhbhWxQMkNQBfT3GEfPp+40igzMPq3reaUTuvag==", + "version": "1.0.65", + "resolved": "https://registry.npmjs.org/@github/copilot-win32-arm64/-/copilot-win32-arm64-1.0.65.tgz", + "integrity": "sha512-/vSE/t9Wm3eFSWpxlKyn/oL8OAVOB0yFO7ECxhgbtiqNrBd1tgpYh1k7IXBIWa/saxlV1+de6DEmPuQfx3Z0bg==", "cpu": [ "arm64" ], @@ -186,9 +186,9 @@ } }, "node_modules/@github/copilot-win32-x64": { - "version": "1.0.64-3", - "resolved": "https://registry.npmjs.org/@github/copilot-win32-x64/-/copilot-win32-x64-1.0.64-3.tgz", - "integrity": "sha512-gHUhS500Q91hjtH9fqKDblaIs0mO09G4ifpZ1woDPXbkdKe/W29uwB7g2fn0+KczNRyPxFSWlqjnOon4Fe8svA==", + "version": "1.0.65", + "resolved": "https://registry.npmjs.org/@github/copilot-win32-x64/-/copilot-win32-x64-1.0.65.tgz", + "integrity": "sha512-wjVWXepET+SpFg8z8V43ZiTy6X1OerCb7yu3QZKNNJ3zY9z20goihPXQCDWkiJpGzszNSgfrsiqUzpUsC9qS0A==", "cpu": [ "x64" ], @@ -582,9 +582,9 @@ } }, "node_modules/js-yaml": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.0.tgz", - "integrity": "sha512-YeLUMlvR4Ou1B119LIaM0r65JvbOBooJDc9yEu0dClb/uSC5P4FrLU8OCCz/HXWvtPoIrR0dRzABTjo1sTN9Bw==", + "version": "4.2.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", + "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", "funding": [ { "type": "github", @@ -600,7 +600,7 @@ "argparse": "^2.0.1" }, "bin": { - "js-yaml": "bin/js-yaml.mjs" + "js-yaml": "bin/js-yaml.js" } }, "node_modules/json-fixer": { diff --git a/package.json b/package.json index 92c25cd24..de38175b2 100644 --- a/package.json +++ b/package.json @@ -42,7 +42,7 @@ "all-contributors-cli": "^6.26.1" }, "dependencies": { - "js-yaml": "^5.2.0", + "js-yaml": "4.2.0", "vfile": "^6.0.3", "vfile-matter": "^5.0.1" } diff --git a/skills/remediation-bash-generator/SKILL.md b/skills/remediation-bash-generator/SKILL.md new file mode 100644 index 000000000..9f95e0725 --- /dev/null +++ b/skills/remediation-bash-generator/SKILL.md @@ -0,0 +1,424 @@ +--- +name: remediation-bash-generator +description: Generate production-ready, idempotent Bash remediation and rollback scripts for cloud infrastructure findings. Use this skill whenever a remediation requires executable shell automation for AWS, Azure, GCP, Kubernetes, Linux, or other infrastructure resources. +--- + +# Production Bash Remediation Generator + +## Purpose + +Your responsibility is to generate production-ready Bash scripts that remediate infrastructure findings safely and consistently. + +This skill generates only: + +- `bash_script` +- `rollback_script` + +Do **not** generate explanations, summaries, remediation reasoning, validation reports, or metadata. Your sole responsibility is producing high-quality executable shell scripts. + +The generated scripts should be suitable for production environments and meet the expectations of experienced DevOps, CloudOps, Platform Engineering, and SRE teams. + +--- + +# Primary Objectives + +Every generated script must satisfy the following goals: + +- Safe to execute +- Safe to execute repeatedly +- Easy to read +- Easy to audit +- Easy to troubleshoot +- Production-ready +- Minimal operational risk + +Generate scripts that would pass a production infrastructure code review with little or no modification. + +--- + +# Script Structure + +Every remediation script must follow this structure. + +## 1. Interpreter + +Always begin with: + +```bash +#!/bin/bash +set -euo pipefail +``` + +Never omit either line. + +--- + +## 2. Purpose Header + +Immediately describe the purpose of the script. + +Example: + +```bash +# ----------------------------------------------------------------------------- +# Remediation: +# Enable versioning on an S3 bucket. +# ----------------------------------------------------------------------------- +``` + +Keep the description concise and focused. + +--- + +## 3. Dependency Validation + +Validate every required CLI tool before performing any operation. + +Examples include: + +- aws +- jq +- kubectl +- az +- gcloud +- terraform +- openssl +- curl + +Only validate tools actually required by the remediation. + +Use: + +```bash +command -v +``` + +Provide clear error messages. + +Example: + +```text +Error: +AWS CLI is not installed or is not available in PATH. +``` + +Never allow the script to fail later because a dependency is missing. + +--- + +## 4. Resource Inputs + +Never hardcode customer-specific values. + +Always expose required resource identifiers as placeholders. + +Examples: + +```text + + + + + + + + + + + + + + + +``` + +Prefer defining variables near the beginning of the script. + +Example: + +```bash +BUCKET_NAME="" +``` + +--- + +## 5. Input Validation + +Validate every required input before continuing. + +Examples include: + +- Empty variables +- Missing identifiers +- Invalid parameter combinations + +Return clear, actionable error messages. + +--- + +## 6. Current State Inspection + +Always inspect the resource before making changes. + +Never assume the finding still exists. + +Prefer read operations before write operations. + +Examples: + +- describe +- get +- show +- list + +Determine whether remediation is actually required. + +--- + +## 7. Idempotency + +Every script must be idempotent. + +Running the script multiple times must always produce a predictable outcome. + +If the resource is already compliant: + +- Explain why +- Skip remediation +- Exit successfully + +Example: + +```text +Versioning is already enabled. + +No remediation required. +``` + +The script must never create duplicate resources or repeatedly apply the same configuration. + +--- + +## 8. Minimal Remediation + +Only perform the minimum changes required to resolve the finding. + +Do not: + +- modify unrelated settings +- update optional configurations +- reconfigure unrelated resources + +Minimize blast radius. + +--- + +## 9. Progress Logging + +Provide concise progress messages. + +Examples: + +```text +Checking current configuration... + +Applying remediation... + +Validating changes... +``` + +Avoid excessive logging. + +Avoid decorative formatting. + +--- + +## 10. Inline Comments + +Use comments to explain non-obvious logic. + +Comments should explain **why** something is being done rather than describing obvious shell syntax. + +Avoid unnecessary comments. + +--- + +## 11. Automated Validation + +Every remediation script must automatically validate its own work. + +Examples: + +```bash +aws ... + +kubectl ... + +gcloud ... + +az ... +``` + +Verify the desired infrastructure state rather than relying only on successful command execution. + +Whenever practical, confirm the resource is now compliant. + +--- + +## 12. Completion + +Finish with a concise success message. + +Example: + +```text +Remediation completed successfully. +``` + +--- + +# Rollback Script Requirements + +Generate a rollback script whenever remediation is reversible. + +The rollback script must: + +- Reverse only the changes introduced by the remediation script. +- Never modify unrelated infrastructure. +- Never assume the rollback is always required. +- Validate the current state before reverting changes. +- Be fully idempotent. + +Rollback scripts must follow the same engineering standards as remediation scripts. + +Specifically they must include: + +- Dependency validation +- Input validation +- Current state inspection +- Idempotency +- Progress logging +- Validation +- Completion message + +If rollback cannot be implemented safely or automatically, clearly state that rollback cannot be automated instead of generating an unsafe rollback script. + +--- + +# Engineering Standards + +## Readability + +Use descriptive variable names. + +Prefer: + +```bash +SECURITY_GROUP_ID +``` + +instead of: + +```bash +SG +``` + +Write code that is easy to understand during production incidents. + +--- + +## Simplicity + +Prefer straightforward Bash. + +Avoid clever one-liners. + +Prioritize maintainability over brevity. + +--- + +## Defensive Programming + +Assume any of the following may occur: + +- Missing resources +- Deleted resources +- Incorrect identifiers +- Missing permissions +- Temporary cloud API failures +- Partial infrastructure state + +Handle failures gracefully with clear error messages. + +--- + +## Deterministic Behaviour + +Given the same infrastructure state, the script should always produce the same outcome. + +Avoid unnecessary randomness or non-deterministic behaviour. + +--- + +## Minimal Blast Radius + +Modify only the resources required for remediation. + +Never make unrelated infrastructure changes. + +--- + +## Production Safety + +Never: + +- Disable security controls +- Reduce IAM permissions unnecessarily +- Ignore command failures +- Suppress errors +- Embed credentials +- Hardcode customer identifiers +- Assume default AWS regions +- Assume default cloud accounts + +Always prefer explicit configuration. + +--- + +# Cloud CLI Best Practices + +When using cloud provider CLIs: + +- Read before writing. +- Validate resource existence before modification. +- Use explicit CLI parameters. +- Avoid relying on CLI defaults. +- Prefer structured output (`--output json`) when parsing responses. +- Use `jq` only when structured parsing improves reliability. + +--- + +# Output Quality Checklist + +Before returning either script, verify that all of the following are true: + +- Starts with `#!/bin/bash` +- Uses `set -euo pipefail` +- Validates required CLI tools +- Uses placeholders instead of customer-specific values +- Validates all required inputs +- Checks current resource state before modification +- Is fully idempotent +- Includes meaningful inline comments +- Performs only the required remediation +- Includes automated post-remediation validation +- Produces clear success or skip messages +- Follows production-grade Bash coding practices + +If any requirement is not satisfied, improve the script before returning it. + +--- + +# Guiding Principle + +Always generate Bash scripts that an experienced DevOps Engineer, Cloud Engineer, Site Reliability Engineer (SRE), or Platform Engineer would confidently execute in a production environment without requiring significant refactoring.