davidbirchall/squad-skills-platform-engineering

Build system principles for TypeScript/Node, Nuxt and Unity projects - deterministic and hermetic builds, lockfiles and frozen installs, dependency pinning and automated updates, caching and incremental builds, build-time vs runtime configuration, artifact naming, checksums and provenance, reproducibility checks, and measuring build speed. Tool-neutral with pnpm examples. Load when making builds repeatable, fixing works-on-my-machine failures, tuning caches, separating build and runtime config, producing release artifacts, or slowing-build investigations.

CI/CD pipeline design, tool-neutral with GitHub Actions illustrations - stages (lint, typecheck, test, build, scan, deploy), fail fast ordering, parallel jobs, dependency caching, required checks, path filters, secrets handling in CI, OIDC and short-lived credentials, promotion between environments, flaky test policy, pipeline as code, runner security, concurrency and timeouts. Load when creating or reviewing pipelines, speeding up or debugging CI, setting required checks, handling secrets or cloud credentials in CI, or defining how builds are promoted to production.

Containerization for Node and NestJS services with Docker and OCI images - multi-stage Dockerfiles, slim pinned base images, non-root users, .dockerignore, layer caching, lockfile-based pnpm installs, health checks, signal handling and graceful shutdown, one process per container, image scanning and SBOMs, small images, compose for local development, resource limits, and read-only filesystems. Load when writing or reviewing a Dockerfile or compose file, shrinking or hardening an image, debugging container startup or shutdown, or preparing a service for deployment.

Provider-neutral deployment patterns - rolling, blue/green and canary strategies, feature-flag and dark launches, immutable deploys, expand/contract database migrations, health and readiness gating, zero-downtime rollouts, rollback strategy, separating deploy from release, progressive delivery, environment promotion of a single artifact, and runbook basics. Load when choosing a rollout strategy, planning a risky or schema-changing deploy, designing rollback, setting up promotion between environments, or writing a deploy runbook.

Environment configuration for Node, NestJS, Nuxt and Unity projects - twelve-factor config in the environment, environment parity across local, dev, staging and prod, typed schema-validated config that fails fast at startup, config versus secrets, sane defaults, feature flags, per-environment overrides, .env handling with a committed .env.example, build-time versus runtime config for frontends, and detecting config drift. Load when adding config or env vars, writing a config module, setting up .env files, or debugging environment-specific behavior.

Git workflows for solo and agent-driven development - trunk-based development with short-lived branches, branch naming, small focused changes, rebase vs merge vs squash, conventional-commit style messages, branch protection driven by automated checks (no approval chains), client and server hooks, force-push safety with lease, recovering mistakes with reflog, worktrees for parallel work, and handling large files and secrets in history. Load when choosing a branching model, naming branches, writing commits, configuring branch protection or hooks, resolving history problems, or running parallel agents on one repo.

Provider-neutral infrastructure as code - declarative definitions in git, modules and composition, remote state with locking, environment separation, plan-before-apply in CI, drift detection, least-privilege deploy identities, keeping secrets out of code and state, tagging and naming conventions, testing and policy-as-code, small blast radius, importing existing resources, and destroy protections. Load when defining, reviewing or changing infrastructure definitions, structuring modules or state, wiring plan and apply into pipelines, or adopting existing manual resources.

Provider-neutral platform monitoring and observability - metrics, logs and traces, golden signals and RED/USE, SLIs, SLOs and error budgets, actionable symptom-based alerts with severity, routing and runbook links, dashboards, log structure and retention, health checks, synthetic checks, alerting to yourself, incident response, blameless postmortems, telemetry cost and cardinality. Load when designing monitoring for services and infrastructure, defining SLOs or alerts, building dashboards, setting up alerting, or running incidents and postmortems.

Monorepo management for TypeScript/Node and multi-project stacks - apps/packages/tooling layout, workspace boundaries, one-way dependency direction rules, shared config packages, internal package conventions, fixed vs independent versioning, affected-only builds and tests, task graph and cache principles, code ownership, and when not to use a monorepo. Tool-neutral; tool-specific task-runner configuration belongs in a separate tool skill. Load when structuring a repo with multiple apps or packages, setting dependency rules, sharing config, choosing a versioning strategy, speeding up CI with affected builds, or deciding monorepo vs polyrepo.

Provider-neutral release management - semantic versioning and when to bump, changelogs, release branches versus trunk tags, release candidates, release checklists, gates, freeze policy, hotfix process, rollback versus roll-forward, release notes, coordinating multi-package releases, release records, and deprecation policy. Load when planning or cutting a release, choosing a versioning or branching strategy, handling a hotfix or rollback, writing release notes, or deprecating features.

Secrets management principles for Node, container and AI-agent stacks - classifying secrets, using a dedicated secret store or manager, runtime injection instead of build-time baking, rotation, least privilege, short-lived and federated credentials, keeping secrets out of git, images, logs and error output, secret scanning and pre-commit detection, incident response for a leaked secret (revoke first, then clean up), access auditing, and handling API keys for AI agents and CI. Load when adding credentials or API keys, wiring secrets into deployments or CI, setting up secret scanning, or responding to a suspected leak.