nebo-devops-cloud — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited nebo-devops-cloud (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Заменяет: devops-automation, docker-best-practices, kubernetes-operations, ci-cd-pipelines, monitoring-observability, aws-cloud-patterns (6 скилов) Триггеры: "docker", "kubernetes", "CI/CD", "деплой", "AWS", "nginx", "systemd", "devops", "monitoring", "Helm" Атомов: 87
cancel-in-progress: true для stale runs, needs для зависимостей между jobsFROM node:22-alpine AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --only=production
FROM node:22-alpine AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build
FROM node:22-alpine AS runtime
WORKDIR /app
RUN addgroup -g 1001 -S app && adduser -S app -u 1001 -G app
COPY --from=deps /app/node_modules ./node_modules
COPY --from=build /app/dist ./dist
USER app
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s CMD wget -qO- http://localhost:3000/healthz || exit 1
CMD ["node", "dist/server.js"]services:
api:
build: { context: ., target: runtime }
depends_on:
db: { condition: service_healthy }
deploy:
resources: { limits: { memory: 512M } }
restart: unless-stoppedconcurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
test:
services:
postgres:
image: postgres:16
options: --health-cmd pg_isready --health-interval 10sspec:
containers:
- resources:
requests: { cpu: 100m, memory: 128Mi }
limits: { cpu: 500m, memory: 512Mi }
livenessProbe:
httpGet: { path: /healthz, port: 8080 }
readinessProbe:
httpGet: { path: /ready, port: 8080 }
topologySpreadConstraints:
- maxSkew: 1
topologyKey: kubernetes.io/hostname
whenUnsatisfiable: DoNotSchedulechart/
Chart.yaml # metadata + dependencies
values.yaml # default values
templates/
deployment.yaml
service.yaml
ingress.yaml
_helpers.tpl # template helpersconst sdk = new NodeSDK({
serviceName: "order-service",
traceExporter: new OTLPTraceExporter({ url: "http://collector:4318/v1/traces" }),
metricReader: new PeriodicExportingMetricReader({
exporter: new OTLPMetricExporter(),
exportIntervalMillis: 15000,
}),
instrumentations: [new HttpInstrumentation(), new PgInstrumentation()],
});tracer.startActiveSpan("name", async (span) => { ... span.end() })meter.create*()// Init outside handler
const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));
export const handler: APIGatewayProxyHandlerV2 = async (event) => {
const result = await client.send(
new GetCommand({ TableName: process.env.TABLE_NAME!, Key: { pk: id } })
);
return { statusCode: 200, body: JSON.stringify(result.Item) };
};logger.info("order_created", {
orderId, customerId, amount,
traceId: span.spanContext().traceId
});jobs:
lint: { runs-on: ubuntu-latest, steps: [checkout, setup-node, npm ci, npm run lint] }
test: { needs: lint, strategy: { matrix: { node: [20, 22] } } }
build: { needs: test, steps: [docker build, docker push] }
deploy: { needs: build, if: "github.ref == 'refs/heads/main'", environment: production }~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.