github-mirrors/opencode-agentic-platform-engineering
1
0
Fork 0
mirror of https://github.com/Team-Rockstars-AI/opencode-agentic-platform-engineering.git synced 2026-09-13 23:53:31 +02:00
Code Issues 5 Projects Releases 3 Packages Wiki Activity
3 releases 3 tags
  • v0.9-prerelease c571d7e9ac

    v0.9-prerelease Stable

    zaph0d released this 2026-06-28 12:31:55 +02:00 | 17 commits to main since this release

    📅 Originally published on GitHub: Sun, 28 Jun 2026 10:32:03 GMT
    🏷️ Git tag created: Sun, 28 Jun 2026 10:31:55 GMT

    v0.9-prerelease — OpenCode Agentic Platform Engineering

    Summary

    This is a starter prerelease of the OpenCode Agentic Platform Engineering template repository. It is suitable for public sharing and cooperative development and is designed to scaffold secure, agentically-maintained Azure platform-engineering repos.

    IMPORTANT: This prerelease has NOT yet been validated against a live Azure subscription. All drift (/drift) and compliance (/compliance) behaviours are implemented and statically validated using local/mocked artefacts only.

    Key capabilities

    • Hardened landing zone modules in Terraform and Bicep:

      • Network baseline (Hub-Spoke, NAT Gateway, Application Gateway + WAF v2, subnet NSGs, micro-segmentation)
      • Key Vault with private endpoints, soft-delete (90 days), purge protection, RBAC authorization, network ACLs (deny by default)
      • OIDC bootstrap for pipelines with least-privilege custom deployer roles (no Contributor/Owner, no wildcards)
      • Enterprise private runners with right-sized CPU/memory and KEDA-style scale-to-zero behaviour (conceptually documented)

    • Agentic team integrated via OpenCode:

      • orchestrator — strategic planner, backlog-driven.
      • builder-infra-tf, builder-infra-bicep, builder-pipelines — IaC and pipeline builders.
      • verifier — validation and dry-run plans.
      • security-auditor — security & compliance scans.
      • plan-validator — blast-radius safety gate.
      • code-reviewer — WAF review (maintainability, reliability, performance, cost, operations).
      • explorer — codebase navigator.
      • test-writer — IaC tests.
      • docs-writer — READMEs, ADRs, runbooks, journals.

    • Slash commands and workflows:

      • /scaffold — generate a new platform-engineering repo (Terraform/Bicep, GitHub/Azure DevOps, governance tier) with templates and modules.
      • /audit — workspace security and compliance scan using security-checklist.
      • /optimise — static cost and resource optimisation engine.
      • /drift — new automated drift detection & reconciliation assistant.
      • /compliance — new regulatory mapping & compliance readiness reporter.
      • /select-models — model optimisation across OpenCode Zen + optional local (Ollama) models.

    Alignment between control repo and templates

    • opencode.json (root) and templates/opencode-config/opencode.json are fully aligned:

      • Same agent set, prompts, skills.
      • Same commands, including /drift and /compliance.

    • Skills have master + template copies:

      • skills/*/SKILL.md and templates/opencode-config/skills/*/SKILL.md pairs for: architecture-review, audit, code-standards, commit-format, compliance, debug, doc-standards, drift, expand, git-workflow, model-optimiser, optimise, plan-tracking, scaffold, security-checklist, test-patterns.

    • Prompts are drift- and compliance-aware in both trees:

      • .opencode/prompts/*.txt and templates/opencode-config/prompts/*.txt aligned for:
        • verifier, plan-validator, security-auditor, docs-writer, code-reviewer, orchestrator, builders.
      • Template prompts include /drift JSON artefact emission, reconciliation annotation, security drift classification, and DRIFT_REPORT generation.
      • Template prompts and skills include /compliance behaviour for security-auditor, code-reviewer, docs-writer.

    • Validation:

      • scripts/validate-team.py PASSES: JSON validity, agent↔prompt mapping, skill references, command wiring, root↔template parity.
      • scripts/validate-skills.py PASSES: no broken skill references across prompts.

    Documentation for human operators

    • Core docs:

      • README.md — architecture, security posture, slash commands (including /drift and /compliance), CI and validation commands.
      • AGENTS.md — agent roles, skills, workflows, and orchestration topology.
      • BUILD_PLAN.md — backlog and epics (Enabler CI, /optimise, /drift, /compliance).
      • BUILD_JOURNAL.md — milestones, changes, friction points, next steps.
      • DISCOVERIES_LOG.md — key discoveries and architectural decisions.

    • Operator manuals under docs/:

      • Provisioning Platform Operator Manual (generator repo).
      • Provisioned Platform Operator Manual (scaffolded repo).
      • Orchestrator Workflow — 9-stage lifecycle and gates.
      • Architecture Blueprint & Network Topology.
      • Regulatory Compliance Mapping Guide.
      • Disaster Recovery & State Reconstruction Runbook.
      • Workload Developer Onboarding Guide.
      • Cost Governance & Sizing Guide.

    • Templates for downstream repos:

      • templates/AGENTS.md — agent & workflow docs for scaffolded repos.
      • ADRs 0001–0006 under templates/docs/adr/ (including 0006: continuous regulatory compliance mapping).
      • Report templates under templates/docs/reports/:
        • cost-optimisation-template.md
        • drift-reconciliation-template.md
        • compliance-readiness-template.md

    Documentation & memory for agents (agentic continuity)

    • Agent configuration:

      • opencode.json — agents, skills, commands, endpoints.
      • templates/opencode-config/opencode.json — same structure for scaffolded repos.

    • Agent memory & governance:

      • .opencode/memory.md — model selection, jurisdiction policy, /select-models flow.
      • BUILD_PLAN.md — authoritative backlog and epic statuses.
      • BUILD_JOURNAL.md — historical milestones and rationale.
      • DISCOVERIES_LOG.md — operational and architectural insights.

    Together, these let a cloned environment be maintained agentically via OpenCode (using /scaffold, /audit, /drift, /compliance, /select-models) without missing context.

    Validation status (important caveat)

    • Static validation:

      • scripts/validate-team.py and scripts/validate-skills.py pass.
      • CI pipelines (azure-pipelines.yml, .github/workflows/ci.yml, .github/workflows/security.yml) run:
        • Python linting and byte-compile.
        • JSON/YAML config validation.
        • Terraform fmt/validate/tflint and Bicep build/lint.
        • Checkov (IaC SAST), gitleaks (secret scan), Bandit (Python SAST).

    • Runtime / cloud validation:

      • /drift and /compliance are implemented, wired, and tested only against local/mocked artefacts.
      • This prerelease has NOT been validated against a live Azure subscription:
        • No live terraform plan / terraform apply against Azure.
        • No live az deployment ... what-if or deployments.
      • A TODO remains (tracked in backlog): run /drift and /compliance against a real subscription, verify DRIFT_REPORT and COMPLIANCE_READINESS_REPORT behaviour, and update documentation accordingly.

    Hosting & CI notes

    • GitHub is currently the primary public host:**

    • Azure DevOps (ADO) remains the intended canonical CI once licensing is available:

      • Root azure-pipelines.yml defines authoritative CI (static validation only; no deployments).
      • Future work: wire an ADO pipeline to this repo and enforce branch policies once ADO is fully available.

    Known limitations and future work

    • No live Azure validation yet for /drift and /compliance — this is the main caveat for v0.9-prerelease.
    • Test suites for drift/compliance are currently based on small mock artefacts; broader .tftest.hcl and harness coverage can be added in later versions.
    • ADO pipeline wiring and branch policies are documented but not enforced until licenses are in place.

    Despite these limitations, v0.9-prerelease provides a robust, secure, and well-documented starting point for cooperative development, and for scaffolding new agentically-maintained platform-engineering repos.

    Downloads
  • v0.2 1f0ce7700f

    v0.2 Stable

    zaph0d released this 2026-06-17 08:51:29 +02:00 | 29 commits to main since this release

    📅 Originally published on GitHub: Thu, 18 Jun 2026 09:47:52 GMT
    🏷️ Git tag created: Wed, 17 Jun 2026 06:51:29 GMT

    Full-system test documentation and execution record for opencode-agentic-platform-engineering.

    Highlights:

    • Added docs/full-system-test.md containing the complete end-to-end system test procedure for the agentic platform.
    • Captured a successful execution of all phases (0–5):
      • Phase 0: Pre-flight checks (JSON validity, skill references, team topology, Terraform/Bicep validation).
      • Phase 1: Scaffolded a test repo under /tmp/platform-test and validated structure, placeholder substitution, security posture, and generated opencode.json topology.
      • Phase 2: Individual agent smoke tests for orchestrator, explorer, builder-infra-tf, builder-infra-bicep, builder-pipelines, verifier, code-reviewer, security-auditor, plan-validator, test-writer, and docs-writer.
      • Phase 3: Slash-command smoke tests for /audit, /debug, /expand, /optimise, and /select-models, all run in read-only or synthetic mode.
      • Phase 4: End-to-end orchestrated workflow for a temporary azure-storage-account Terraform module, including build, verify, review, security, safety, tests, and docs gates (all PASSED), followed by removal of the temporary module in cleanup.
      • Phase 5: Full cleanup returning the repo to a clean state (no test artefacts left; validation scripts green).
    • Explicitly documented that the full-system test runs without any live Azure subscription: all terraform operations use -backend=false and safety checks use synthetic plan JSON.
    • Added an example opencode stats snapshot showing that the project’s model usage over a full day (including this test) cost ~.71 with no cloud resource charges, demonstrating that the full-system test is extremely cheap to run.

    This release is documentation/validation focused only; no scaffold templates or infrastructure modules were changed in the final repo state.

    Downloads
  • v0.1 8dd3725e72

    v0.1-pre — EU-Sovereign Agentic Configuration Layer Pre-release

    zaph0d released this 2026-06-15 14:46:58 +02:00 | 32 commits to main since this release

    📅 Originally published on GitHub: Mon, 15 Jun 2026 12:47:14 GMT
    🏷️ Git tag created: Mon, 15 Jun 2026 12:46:58 GMT

    Introduction

    This release marks the completion of the EU-Sovereignty Agentic Configuration Layer milestone. We have systematically refactored the local agentic configuration layer to achieve strict data sovereignty and geopolitical compliance.

    This platform engineering repository scaffolds secure, compliant, and opinionated Azure landing zones and workload pipelines. With this release, the local multi-agent team (orchestrator, builders, auditors, and verifiers) is fully functional, secure, and aligned with EU data sovereignty standards.

    Highlights of All Commits in this Release

    • Sovereign-Friendly Model Migration: Migrated all Code-Generation and Task-Execution subagents from unavailable Mistral/Ollama endpoints to Cohere North Mini Code (opencode/north-mini-code-free), a highly capable, sovereign-friendly (Canadian-based, Apache 2.0), non-US, and non-Chinese model hosted for free on OpenCode.
    • Orchestrator Alignment: Configured the primary orchestrator to utilize Gemini 3.5 Flash (opencode/gemini-3.5-flash) as the authorized high-reasoning fallback for complex planning and task decomposition.
    • Sovereignty Policy Enforcement: Implemented a robust Python configuration layer (agent_config.py) with a strict SECURITY_POLICY that automatically overrides non-compliant models with sovereign-friendly defaults.
    • Jurisdiction Validation Hook: Added a validation hook that logs the origin jurisdiction of every model used in the orchestration loop and triggers a critical alert/exception if a non-EU, non-authorized model is selected for a restricted task.
    • Automated Verification Gating: Verified all 22 prompt files using the automated skill reference validator (validate-skills.py) and confirmed that all configurations are 100% syntactically valid.
    • Security Hardening & Micro-segmentation: Remediated critical security findings by implementing custom least-privilege pipeline roles, enabling Key Vault purge protection and network isolation, adding subnet-level NSGs, and enforcing strict pipeline error propagation (set -euo pipefail).
    • High-Value Provisioning Enhancements: Integrated an automated scaffolding script (scaffold.py), local pre-commit compliance hooks (Gitleaks, Checkov), and pre-populated Architecture Decision Records (ADRs) to establish immediate governance.
    Downloads