Specs¶
Specs live in the project wiki, not in this repository.
A spec is a point-in-time decision record — written once, true of a moment, read
later for its conclusions. Living documentation stays here in docs/, because it
changes with the components.
| # | Title | Status |
|---|---|---|
| 0001 | phpboyscout/cicd v0.1 — reusable GitLab CI/CD components | APPROVED |
| 0002 | phpboyscout/cicd v0.3 — tofu-apply plan sources + tag/MR rules | APPROVED |
| 0003 | phpboyscout/cicd v0.2 — tofu-plan / tofu-apply components | APPROVED |
| 0004 | phpboyscout/cicd v0.4 — gate components run in merge-request pipelines | APPROVED |
| 0005 | phpboyscout/cicd v0.5 — configurable token inputs | APPROVED |
| 0006 | phpboyscout/cicd v0.6 — OpenTofu provider plugin cache | APPROVED |
| 0007 | phpboyscout/cicd v0.7 — tofu-module-publish component | APPROVED |
| 0008 | phpboyscout/cicd v0.7.2 — resolved-modules cache on tofu-validate | APPROVED |
| 0009 | phpboyscout/cicd v0.8 — renovate-self component + shared Renovate preset | APPROVED |
| 0010 | phpboyscout/cicd v0.9 — Go track (go-lint, go-test, go-security, gorelea | APPROVED |
| 0011 | phpboyscout/cicd v0.10 — Rust track (rust-lint, rust-test, rust-security | APPROVED |
| 0012 | Scope gitleaks scans to pipeline commits (cross-branch false positives) | APPROVED |
| 0013 | Split release-plz into separate pr / release jobs (publish never fires) | APPROVED |
| 0014 | phpboyscout/cicd v0.10.5 — goreleaser auto-retries transient release fai | APPROVED |
| 0015 | Order release-plz:pr after release-plz:release (propagation race) | APPROVED |
| 0016 | release-plz — checkout the pipeline commit, not a stale branch ref | APPROVED |
| 0017 | renovate-self — stop the token input self-referencing RENOVATE_TOKEN | APPROVED |
| 0018 | phpboyscout/cicd v0.11.1 — gate components skip tag pipelines | APPROVED |
| 0019 | phpboyscout/cicd v0.11.2 — bump default Go image to 1.26.4 | APPROVED |
| 0020 | phpboyscout/cicd v0.11.3 — goreleaser gotoolchain defaults to auto | APPROVED |
| 0021 | phpboyscout/cicd v0.11 — releaser-pleaser component | APPROVED |
| 0022 | phpboyscout/cicd v0.10.8 — only renovate-self runs on scheduled pipeline | APPROVED |
| 0023 | phpboyscout/cicd — self-test fan-out churn scoping | APPROVED |
| 0024 | phpboyscout/cicd v0.14.0 — go/rust components use the dev-tools image | APPROVED |
| 0025 | phpboyscout/cicd v0.12.0 — hugo-pages component | APPROVED |
| 0026 | phpboyscout/cicd v0.13.0 — hugo-pages mr_gate (selectable build gate) | APPROVED |
| 0027 | phpboyscout/cicd v0.11.5 — interruptible gate jobs + cache churn/key red | APPROVED |
| 0028 | phpboyscout/cicd v0.11.4 — bump default Renovate image to 43 | APPROVED |
| 0029 | phpboyscout/cicd — change-detection (rules:changes) across components | IMPLEMENTED |
| 0030 | phpboyscout/cicd v0.19.0 — skill-security (Claude skill / instruction-fi | APPROVED |
| 0031 | phpboyscout/cicd — svelte-* frontend track (build, lint, test, security) | IMPLEMENTED |
| 0032 | phpboyscout/cicd — restructure docs into Diátaxis | APPROVED |
| 0033 | phpboyscout/cicd v0.20.0 — goreleaser Pro toggle (pro: true) |
DRAFT |
| 0034 | phpboyscout/cicd v0.20.2 — auto-track the dev-tools / infra-tools image | APPROVED |
| 0035 | phpboyscout/cicd — osv-scanner toolchain resilience, repo config, and a | APPROVED |
| 0036 | phpboyscout/cicd v0.21.2 — publish the Renovate preset as default.json | APPROVED |
| 0037 | phpboyscout/cicd v0.22.0 — tofu-plan/apply job_name + change-detection | APPROVED |
| 0038 | phpboyscout/cicd v0.21.1 — auto-track the scanner tool images in the *-s | APPROVED |
| 0039 | phpboyscout/cicd — bake the zensical docs toolchain into the infra-tools | APPROVED |
| 0040 | Guard the workflow dedup rule so tag pipelines always fire | APPROVED |
| 0041 | Scope releaser-pleaser's pending-release lookup to the running project | APPROVED |
| 0042 | Replace the weekly Renovate window with a release soak | APPROVED |
| 0043 | Regenerate terraform-docs tables during the Renovate run, not after it | APPROVED |
| 0044 | Authenticate tflint's ruleset lookup in tofu-lint | APPROVED |
| 0045 | Serialise rust-* compile jobs with a resource_group input | APPROVED |
| 0046 | Automerge first-party cicd component pins fleet-wide | APPROVED |
| 0047 | Opt-in dind integration job for go-test (testcontainers-go) | APPROVED |
| 0048 | A renovate-group component: one autodiscover run for the whole group | APPROVED |
| 0049 | renovate-group run headroom: a job timeout so a growing group never star | APPROVED |
| 0050 | Centralized, composable Renovate presets (leaf model) | APPROVED |
| 0051 | Run go-test/go-lint on CHANGELOG-only Release MRs | IMPLEMENTED |
| 0052 | Strip generated files from the go-test coverage badge | IMPLEMENTED |
| 0053 | releaser-pleaser must wait for earlier stages (drop needs:[]) | IMPLEMENTED |
| 0054 | Shared runner cache for scanner vuln DBs (trivy + osv-scanner, hermetic) | IMPLEMENTED |
| 0055 | Renovate completes Go major bumps (gomodUpdateImportPaths) | APPROVED |
| 0056 | Stoppable environments — catalog schema v2, tofu-stop, and environment i | APPROVED |
| 0057 | tofu-deploy-generate — catalog-driven deploy child-pipeline generator co | APPROVED |
| 0058 | renovate-merge: a merge-sweep for green Renovate MRs under FF | APPROVED |
| 0059 | Renovate does not rewrite Go tool directives on a major bump |
APPROVED |
| 0060 | tofu-module-publish must not default into a built-in stage |
APPROVED |
| 0061 | releaser-pleaser tags the pre-rebase head on a fast-forward project | APPROVED |
| 0062 | Enable the Renovate pre-commit manager in the base preset |
APPROVED |
| 0063 | goreleaser retry must migrate off the reasons GitLab 19.1 split |
APPROVED |
| 0064 | Discord release announcements, filtered to the cuts worth reading | APPROVED |
| 0065 | Track the pins no Renovate manager reads: Dockerfile ARG and component inputs.image |
IMPLEMENTED |
| 0066 | renovate-group can fail invisibly: its trace outgrows GitLab's 4 MB cap | IMPLEMENTED |
| 0067 | release-train: sequence the estate's dependency cascade, because Renovate structurally cannot | APPROVED |
| 0068 | docs-verify: an always-on gate for a project's documentation checks | DRAFT |
| 0069 | Install-time script execution must be a property of the job, not of each command | IMPLEMENTED |
| 0070 | A documentation gate must be always-on (superseded by 0068; retained for its reasoning) | SUPERSEDED |
| 0071 | retire must not fetch its vulnerability database anonymously from GitHub | IMPLEMENTED |
| 0072 | OpenTofu's required_version must track OpenTofu, not Terraform (renumbered from 0068) |
IMPLEMENTED |
| 0073 | release-stamp: a closed issue must say which release shipped it | IMPLEMENTED |
| 0074 | Rebase the CI images onto Wolfi, and decompose them by track | IMPLEMENTED |
| 0075 | A Go release orchestrator, owned rather than consumed | DRAFT |
| 0076 | playwright-tools — give the browser its own image | APPROVED |
Referring to a spec¶
By number and name — "0050, the centralised Renovate presets spec" — never by date. The number is a stable handle; a date is not something anyone remembers.
Writing a new one¶
Claim the next number first, then draft against the canonical shape. See the
spec-driven-development skill in the phpboyscout marketplace.