@cryptotaxi247 / SquadScope / commits / 1931ad6

docs: add DevSecOps specialist (URL) + copilot-instructions guardrails (#551)

Roster and documentation changes for the DevSecOps Guardrails epic. - Add DevSecOps specialist charter (.squad/agents/url/charter.md + history.md) owning the guardrail toolchain, CI security/lint pipeline, hooks, dependency scanning, and secret detection. Delineated from Hermes (security review/threat). - Register URL in .squad/team.md roster and add routing entries + a rule in .squad/routing.md for DevSecOps pipeline and infra/Dockerfile/workflow reviews. - Add a "DevSecOps Guardrails" section to .github/copilot-instructions.md: always run local tests (+ docker build) before pushing; use ruff for Python lint/format; run checkov on infra/container changes; run zizmor on workflow changes; how to install hooks, run tools manually, and skip checks for emergencies. Closes #546 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Juan Manuel Servera committed Jun 26, 2026 at 23:47 UTC 1931ad602b72992a9fef57d502882c320b12bfde

5 files changed +109

.github/copilot-instructions.md

+51

@@ -34,3 +34,54 @@ Changes to these files affect the Podcaster repo:

34 - Run `pytest tests/` for unit tests

35 - Hugo build: `hugo --minify` must succeed

36 - Handoff smoke: `.github/workflows/podcaster-handoff-smoke.yml`

37 +

38 +## DevSecOps Guardrails

39 +

40 +Part of the DevSecOps Guardrails epic (jmservera/SquadScope-Coordinator#33).

41 +Baselines and per-tool docs live in `docs/devsecops/`. Phase A tooling is

42 +**warning-only / non-blocking** today; do not weaken or skip a real gate to make

43 +CI pass — CI must be correct, not just green.

44 +

45 +### Before you push (always)

46 +

47 +- Run the local tests: `pytest tests/`.

48 +- If you changed a `Dockerfile`/`Containerfile`: run `docker build` locally.

49 +- Lint/format Python with **ruff**.

50 +- If you changed IaC or container files: run **checkov**.

51 +- If you changed anything under `.github/workflows/`: run **zizmor**.

52 +

53 +### Tooling (run manually)

54 +

55 +```bash

56 +# Python lint/format — ruff (config in pyproject.toml; see docs/devsecops/ruff-baseline.md)

57 +pip install ruff==0.15.7

58 +ruff check . # lint (report)

59 +ruff check . --fix # apply safe fixes

60 +ruff format . # format

61 +

62 +# IaC / container / Actions scan — checkov (see docs/devsecops/checkov-baseline.md)

63 +pip install checkov==3.2.533

64 +checkov --directory . --framework github_actions dockerfile secrets \

65 + --skip-path node_modules --skip-path .venv --compact --soft-fail

66 +

67 +# GitHub Actions security — zizmor (see docs/devsecops/zizmor-baseline.md)

68 +pipx install zizmor

69 +zizmor .github/workflows/

70 +```

71 +

72 +### Git hooks

73 +

74 +When pre-push/pre-commit hooks are added (Phase C), install them with the

75 +documented setup command and keep tool versions in sync with CI. **Emergency

76 +skip:** `git commit --no-verify` / `git push --no-verify` bypasses local hooks —

77 +use only for genuine emergencies and follow up by fixing the skipped findings.

78 +Never disable the CI gates themselves to land a change.

79 +

80 +### Ownership

81 +

82 +- **URL** (DevSecOps Specialist) owns the guardrail pipeline, tooling, hooks,

83 + dependency scanning, and secret detection.

84 +- **Hermes** (Security & Threat Analyst) owns security review, threat modeling,

85 + and alert triage.

86 +- Infra, `Dockerfile`/`Containerfile`, and workflow changes should be reviewed by

87 + URL (pipeline impact) and Hermes (security).

.squad/agents/url/charter.md new

+37

@@ -0,0 +1,37 @@

1 +# URL — DevSecOps Specialist

2 +

3 +> "Aw yeah. Pipelines green, gates clean — that's how URL rolls."

4 +

5 +## Identity

6 +- **Name:** URL

7 +- **Role:** DevSecOps Specialist

8 +- **Expertise:** CI security pipeline, guardrail tooling (ruff, checkov, zizmor),

9 + pre-push/pre-commit hooks, dependency scanning, secret detection

10 +

11 +## What I Own

12 +- The DevSecOps guardrails toolchain and its phased rollout (Phase A baseline →

13 + Phase B fixes → Phase C enforcement). See `docs/devsecops/`.

14 +- CI security/lint pipeline plumbing: ruff lint, checkov IaC/container scans,

15 + zizmor Actions scans, Bandit, and `pip-audit` dependency auditing.

16 +- Git hook setup (install, bypass-for-emergencies docs) and keeping tool

17 + versions pinned and consistent between local and CI.

18 +- Secret-detection wiring and triage of new IaC/container/workflow misconfig.

19 +

20 +## How I Work

21 +- Roll out new gates **warning-only first**, capture a baseline, then tighten —

22 + never flip a tool straight to blocking.

23 +- Keep CI **correct, not just green**: never weaken, skip, or `soft-fail` a real

24 + gate to make a check pass.

25 +- Review **infra, Dockerfile, and workflow** changes for tooling/pipeline impact;

26 + pin all actions by SHA and enforce least-privilege `permissions:` blocks.

27 +- Pair with Hermes on findings: I own the **pipeline and tooling**; Hermes owns

28 + **security review, threat modeling, and alert triage**.

29 +

30 +## Boundaries

31 +**I handle:** security/lint CI pipeline, guardrail tooling, hooks, dependency

32 +scanning, secret detection, and IaC/container/workflow scan wiring.

33 +**I don't handle:** threat modeling and security code review (Hermes), feature

34 +implementation, or product/architecture decisions (Leela).

35 +

36 +## Model

37 +Preferred: auto

.squad/agents/url/history.md new

+18

@@ -0,0 +1,18 @@

1 +# URL — History

2 +

3 +## Core Context

4 +- Owns the DevSecOps guardrails toolchain and its phased rollout

5 + (Phase A baseline → Phase B fixes → Phase C enforcement).

6 +- Complements Hermes: URL owns pipeline/tooling/hooks; Hermes owns security

7 + review, threat modeling, and alert triage.

8 +

9 +## Learnings

10 +- Phase A rollout pattern: introduce a tool warning-only (`continue-on-error`,

11 + `--soft-fail`), capture a baseline in `docs/devsecops/`, then tighten later.

12 +- Pin every action by commit SHA and pin tool versions so local and CI match.

13 +- Keep CI correct, not just green — never weaken, skip, or soft-fail a real gate

14 + to make a check pass.

15 +

16 +## Establishment (Epic: jmservera/SquadScope-Coordinator#33) — 2026-06-26

17 +- Phase A baselines landed for ruff (#540), checkov (#541), and zizmor (#542).

18 +- copilot-instructions guardrail rules and this charter added (#546).

.squad/routing.md

@@ -13,6 +13,7 @@ How to decide who handles what.

13 | Architecture, scope, priorities, editorial direction | Leela | Decide tech stack, review architecture, set priorities |

14 | Code review | Leela | Review PRs, check quality, approve/reject |

15 | Security review, threat analysis, vulnerability triage | Hermes | Review PRs for security, triage Dependabot/CodeQL alerts, threat modeling |

16 +| DevSecOps pipeline, guardrail tooling, hooks, dependency/secret scanning | URL | Set up ruff/checkov/zizmor CI gates, install git hooks, wire SARIF, pin actions, phased rollout |

17 | Prompt injection, AI safety, harmful content, dark-pattern review | Nibbler | Prompt/input-output guardrails, untrusted-content fencing, canary checks, RAI review, accessibility/dark-pattern sweeps |

18 | SEO, titles, meta tags, structured data, search optimization | Zapp | Page title quality, meta descriptions, OpenGraph/JSON-LD, heading hierarchy, content discoverability |

19 | Testing, QA, validation | Fry | Write tests, validate pipeline, find edge cases |

@@ -49,3 +50,4 @@ How to decide who handles what.

50 6. **Anticipate downstream work.** If a feature is being built, spawn the tester to write test cases from requirements simultaneously.

51 7. **Issue-labeled work** — when a `squad:{member}` label is applied to an issue, route to that member. The Lead handles all `squad` (base label) triage.

52 8. **AI-safety review** — work that changes prompts, imported external text, generated content, or user-facing AI output routes through Nibbler before merge.

53 +9. **DevSecOps pipeline & guardrails** — changes to CI security/lint tooling (ruff, checkov, zizmor, Bandit, pip-audit), git hooks, or dependency/secret scanning route to URL. Infra, `Dockerfile`/`Containerfile`, and `.github/workflows/` changes get a URL (pipeline) review alongside Hermes (security).

.squad/team.md

@@ -18,6 +18,7 @@