Specs¶
Specs live in the project wiki, not in this repository.
A spec is a point-in-time decision record — written once, true of a moment, read
later for its conclusions. Living documentation stays here in docs/, because it
changes with the components.
| # | Title | Status |
|---|---|---|
| 0001 | phpboyscout/cicd v0.1 — reusable GitLab CI/CD components | IMPLEMENTED |
| 0002 | phpboyscout/cicd v0.3 — tofu-apply plan sources + tag/MR rules | IMPLEMENTED |
| 0003 | phpboyscout/cicd v0.2 — tofu-plan / tofu-apply components | IMPLEMENTED |
| 0004 | phpboyscout/cicd v0.4 — gate components run in merge-request pipelines | IMPLEMENTED |
| 0005 | phpboyscout/cicd v0.5 — configurable token inputs | IMPLEMENTED |
| 0006 | phpboyscout/cicd v0.6 — OpenTofu provider plugin cache | IMPLEMENTED |
| 0007 | phpboyscout/cicd v0.7 — tofu-module-publish component | IMPLEMENTED |
| 0008 | phpboyscout/cicd v0.7.2 — resolved-modules cache on tofu-validate | IMPLEMENTED |
| 0009 | phpboyscout/cicd v0.8 — renovate-self component + shared Renovate preset | IMPLEMENTED |
| 0010 | phpboyscout/cicd v0.9 — Go track (go-lint, go-test, go-security, gorelea | IMPLEMENTED |
| 0011 | phpboyscout/cicd v0.10 — Rust track (rust-lint, rust-test, rust-security | IMPLEMENTED |
| 0012 | Scope gitleaks scans to pipeline commits (cross-branch false positives) | IMPLEMENTED |
| 0013 | Split release-plz into separate pr / release jobs (publish never fires) | IMPLEMENTED |
| 0014 | phpboyscout/cicd v0.10.5 — goreleaser auto-retries transient release fai | IMPLEMENTED |
| 0015 | Order release-plz:pr after release-plz:release (propagation race) | IMPLEMENTED |
| 0016 | release-plz — checkout the pipeline commit, not a stale branch ref | IMPLEMENTED |
| 0017 | renovate-self — stop the token input self-referencing RENOVATE_TOKEN | IMPLEMENTED |
| 0018 | phpboyscout/cicd v0.11.1 — gate components skip tag pipelines | IMPLEMENTED |
| 0019 | phpboyscout/cicd v0.11.2 — bump default Go image to 1.26.4 | IMPLEMENTED |
| 0020 | phpboyscout/cicd v0.11.3 — goreleaser gotoolchain defaults to auto | IMPLEMENTED |
| 0021 | phpboyscout/cicd v0.11 — releaser-pleaser component | IMPLEMENTED |
| 0022 | phpboyscout/cicd v0.10.8 — only renovate-self runs on scheduled pipeline | IMPLEMENTED |
| 0023 | phpboyscout/cicd — self-test fan-out churn scoping | IMPLEMENTED |
| 0024 | phpboyscout/cicd v0.14.0 — go/rust components use the dev-tools image | IMPLEMENTED |
| 0025 | phpboyscout/cicd v0.12.0 — hugo-pages component | IMPLEMENTED |
| 0026 | phpboyscout/cicd v0.13.0 — hugo-pages mr_gate (selectable build gate) | IMPLEMENTED |
| 0027 | phpboyscout/cicd v0.11.5 — interruptible gate jobs + cache churn/key red | IMPLEMENTED |
| 0028 | phpboyscout/cicd v0.11.4 — bump default Renovate image to 43 | IMPLEMENTED |
| 0029 | phpboyscout/cicd — change-detection (rules:changes) across components | IMPLEMENTED |
| 0030 | phpboyscout/cicd v0.19.0 — skill-security (Claude skill / instruction-fi | IMPLEMENTED |
| 0031 | phpboyscout/cicd — svelte-* frontend track (build, lint, test, security) | IMPLEMENTED |
| 0032 | phpboyscout/cicd — restructure docs into Diátaxis | IMPLEMENTED |
| 0033 | phpboyscout/cicd v0.20.0 — goreleaser Pro toggle (pro: true) |
IMPLEMENTED |
| 0034 | phpboyscout/cicd v0.20.2 — auto-track the dev-tools / infra-tools image | IMPLEMENTED |
| 0035 | phpboyscout/cicd — osv-scanner toolchain resilience, repo config, and a | IMPLEMENTED |
| 0036 | phpboyscout/cicd v0.21.2 — publish the Renovate preset as default.json | IMPLEMENTED |
| 0037 | phpboyscout/cicd v0.22.0 — tofu-plan/apply job_name + change-detection | IMPLEMENTED |
| 0038 | phpboyscout/cicd v0.21.1 — auto-track the scanner tool images in the *-s | IMPLEMENTED |
| 0039 | phpboyscout/cicd — bake the zensical docs toolchain into the infra-tools | IMPLEMENTED |
| 0040 | Guard the workflow dedup rule so tag pipelines always fire | IMPLEMENTED |
| 0041 | Scope releaser-pleaser's pending-release lookup to the running project | IMPLEMENTED |
| 0042 | Replace the weekly Renovate window with a release soak | IMPLEMENTED |
| 0043 | Regenerate terraform-docs tables during the Renovate run, not after it | IMPLEMENTED |
| 0044 | Authenticate tflint's ruleset lookup in tofu-lint | IMPLEMENTED |
| 0045 | Serialise rust-* compile jobs with a resource_group input | IMPLEMENTED |
| 0046 | Automerge first-party cicd component pins fleet-wide | IMPLEMENTED |
| 0047 | Opt-in dind integration job for go-test (testcontainers-go) | IMPLEMENTED |
| 0048 | A renovate-group component: one autodiscover run for the whole group | IMPLEMENTED |
| 0049 | renovate-group run headroom: a job timeout so a growing group never star | IMPLEMENTED |
| 0050 | Centralized, composable Renovate presets (leaf model) | IMPLEMENTED |
| 0051 | Run go-test/go-lint on CHANGELOG-only Release MRs | IMPLEMENTED |
| 0052 | Strip generated files from the go-test coverage badge | IMPLEMENTED |
| 0053 | releaser-pleaser must wait for earlier stages (drop needs:[]) | IMPLEMENTED |
| 0054 | Shared runner cache for scanner vuln DBs (trivy + osv-scanner, hermetic) | IMPLEMENTED |
| 0055 | Renovate completes Go major bumps (gomodUpdateImportPaths) | IMPLEMENTED |
| 0056 | Stoppable environments — catalog schema v2, tofu-stop, and environment i | IMPLEMENTED |
| 0057 | tofu-deploy-generate — catalog-driven deploy child-pipeline generator co | IMPLEMENTED |
| 0058 | renovate-merge: a merge-sweep for green Renovate MRs under FF | IMPLEMENTED |
| 0059 | Renovate does not rewrite Go tool directives on a major bump |
IMPLEMENTED |
| 0060 | tofu-module-publish must not default into a built-in stage |
IMPLEMENTED |
| 0061 | releaser-pleaser tags the pre-rebase head on a fast-forward project | IMPLEMENTED |
| 0062 | Enable the Renovate pre-commit manager in the base preset |
IMPLEMENTED |
| 0063 | goreleaser retry must migrate off the reasons GitLab 19.1 split |
IMPLEMENTED |
| 0064 | Discord release announcements, filtered to the cuts worth reading | SUPERSEDED |
| 0065 | Track the pins no Renovate manager reads: Dockerfile ARG and component inputs.image |
IMPLEMENTED |
| 0066 | renovate-group can fail invisibly: its trace outgrows GitLab's 4 MB cap | IMPLEMENTED |
| 0067 | release-train: sequence the estate's dependency cascade, because Renovate structurally cannot | IMPLEMENTED |
| 0068 | docs-verify: an always-on gate for a project's documentation checks | IMPLEMENTED |
| 0069 | Install-time script execution must be a property of the job, not of each command | IMPLEMENTED |
| 0070 | A documentation gate must be always-on (superseded by 0068; retained for its reasoning) | SUPERSEDED |
| 0071 | retire must not fetch its vulnerability database anonymously from GitHub | IMPLEMENTED |
| 0072 | OpenTofu's required_version must track OpenTofu, not Terraform (renumbered from 0068) |
IMPLEMENTED |
| 0073 | release-stamp: a closed issue must say which release shipped it | IMPLEMENTED |
| 0074 | Rebase the CI images onto Wolfi, and decompose them by track | IMPLEMENTED |
| 0075 | A Go release orchestrator, owned rather than consumed | SUPERSEDED |
| 0076 | playwright-tools — give the browser its own image | IMPLEMENTED |
| 0077 | A colophon component, and the swap away from releaser-pleaser | IMPLEMENTED |
| 0078 | The fleet move from releaser-pleaser to colophon | IMPLEMENTED |
| 0079 | Pipeline churn on three runner slots | IMPLEMENTED |
| 0080 | go-singleuse: the advisory job for controls' single-use lint | IMPLEMENTED |
| 0081 | A tool bump that changes what an image ships must release it | IMPLEMENTED |
| 0082 | Pins nothing tracks, and fixtures pinned to retired images | IMPLEMENTED |
| 0083 | A merge-time apply job on the colophon component | IMPLEMENTED |
| 0084 | Component tags: what colophon-release runs for, and what the release check reads | IMPLEMENTED |
| 0085 | A documented version floor is not a pin, and Renovate must not ratchet it | IMPLEMENTED |
| 0086 | A project that names its own assets, and the input it must blank | IMPLEMENTED |
| 0087 | The unit test job's timeout, and the runner it now always lands on | IMPLEMENTED |
| 0088 | A tool a component runs is part of what it ships | APPROVED |
| 0089 | Every docs site carries a map for machine readers | IMPLEMENTED |
| 0090 | exclude_docs is honoured by the component, because Zensical ignores it | IMPLEMENTED |
| 0091 | Every docs page names its site, its software and its author in structured data | IMPLEMENTED |
| 0092 | The component fills in two zensical.toml values the estate always gets wrong by default | IMPLEMENTED |
| 0093 | tofu-plan, tofu-apply and tofu-stop run a stack that has no AWS identity | DRAFT |
| 0094 | SPIKE: retag the sha- image on a release instead of rebuilding it | IMPLEMENTED |
| 0095 | verify-release-binaries — detection replaces enforcement for the release store | IN PROGRESS |
| 0096 | goreleaser refuses to republish a tag that is already published | IN PROGRESS |
| 0097 | One signing binary in the base image, instead of building one per release | IMPLEMENTED |
| 0098 | SPIKE: kaniko is archived — what replaces it, and what that does NOT fix | IMPLEMENTED |
| 0099 | The nightly scan keeps a tracked dashboard issue per image | IMPLEMENTED |
| 0100 | Release announcements move to colophon announce; discord-release is decommissioned | IMPLEMENTED |
| 0101 | go-test says how many tests it skipped | IMPLEMENTED |
| 0102 | A family member's release MR checks it requires its core's latest release | IMPLEMENTED |
| 0103 | go-core-currency checks every first-party module, warning where it is not a core | APPROVED |
| 0105 | go-security and svelte-security stop colliding on osv-scanner and gitleaks | IMPLEMENTED |
Referring to a spec¶
By number and name — "0050, the centralised Renovate presets spec" — never by date. The number is a stable handle; a date is not something anyone remembers.
Writing a new one¶
Claim the next number first, then draft against the canonical shape. See the
spec-driven-development skill in the phpboyscout marketplace.