Gear

questions:
  - question: "Infrastructure configuration will be changed. What scope would you like to apply?"
    header: "Infra Change"
    options:
      - label: "Minimal changes (Recommended)"
        description: "Modify only necessary parts, leave other settings untouched"
      - label: "Optimize including related settings"
        description: "Improve surrounding settings as well"
      - label: "Review impact scope first"
        description: "Display list of affected files before making changes"
    multiSelect: false

questions:
  - question: "Dependencies will be updated. Which approach would you like to use?"
    header: "Dependency Update"
    options:
      - label: "Patch/Minor only (Recommended)"
        description: "Update within safe range, avoid breaking changes"
      - label: "Include major versions"
        description: "Follow latest versions, migration work required"
      - label: "Security fixes only"
        description: "Address only vulnerabilities detected by audit"
    multiSelect: false

questions:
  - question: "CI/CD pipeline will be modified. How would you like to proceed?"
    header: "CI/CD Change"
    options:
      - label: "Apply incrementally (Recommended)"
        description: "Verify on one job first, deploy after success"
      - label: "Apply all at once"
        description: "Update all workflows simultaneously"
      - label: "Dry run review"
        description: "Display changes only, defer execution"
    multiSelect: false

questions:
  - question: "Environment variables or secrets management will be modified. How would you like to handle this?"
    header: "Environment Config"
    options:
      - label: "Update .env.example only (Recommended)"
        description: "Update template, do not touch actual values"
      - label: "Review secrets management"
        description: "Include GitHub Secrets and other settings"
      - label: "Documentation only"
        description: "Document changes in README, defer implementation"
    multiSelect: false

questions:
  - question: "Build toolchain change is being considered. How would you like to proceed?"
    header: "Build Tools"
    options:
      - label: "Optimize existing tools (Recommended)"
        description: "Improve current tool configuration"
      - label: "Gradual migration"
        description: "Set up parallel operation period and switch gradually"
      - label: "PoC verification"
        description: "Try new tool in separate branch and report results"
    multiSelect: false

questions:
  - question: "Monorepo configuration will be changed. How would you like to proceed?"
    header: "Monorepo"
    options:
      - label: "Workspace settings only (Recommended)"
        description: "Change only pnpm-workspace.yaml or package.json workspaces"
      - label: "Include build pipeline"
        description: "Include Turborepo / NX settings changes"
      - label: "Impact analysis first"
        description: "Confirm scope of impact before making changes"
    multiSelect: false

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v3
        with:
          version: 9

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile
      - run: pnpm lint

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v3
        with:
          version: 9

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile
      - run: pnpm test

      - uses: actions/upload-artifact@v4
        if: failure()
        with:
          name: test-results
          path: coverage/
          retention-days: 7

  build:
    runs-on: ubuntu-latest
    needs: [lint, test]
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v3
        with:
          version: 9

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile
      - run: pnpm build

      - uses: actions/upload-artifact@v4
        with:
          name: build
          path: dist/
          retention-days: 7

# .github/workflows/test-matrix.yml
name: Test Matrix

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node: [18, 20, 22]

    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v3
        with:
          version: 9

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile
      - run: pnpm test

# .github/workflows/deploy.yml
name: Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:
    inputs:
      environment:
        description: 'Deploy environment'
        required: true
        default: 'staging'
        type: choice
        options:
          - staging
          - production

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ github.event.inputs.environment || 'staging' }}

    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v3
        with:
          version: 9

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile
      - run: pnpm build

      # Vercel deployment example
      - name: Deploy to Vercel
        uses: amondnet/vercel-action@v25
        with:
          vercel-token: ${{ secrets.VERCEL_TOKEN }}
          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
          vercel-args: ${{ github.event.inputs.environment == 'production' && '--prod' || '' }}

# .github/workflows/release.yml
name: Release

on:
  push:
    branches: [main]

permissions:
  contents: write
  issues: write
  pull-requests: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: pnpm/action-setup@v3
        with:
          version: 9

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile

      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npx semantic-release

# .github/dependabot.yml
version: 2
updates:
  # npm dependencies
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    open-pull-requests-limit: 10
    groups:
      dev-dependencies:
        dependency-type: "development"
        patterns:
          - "*"
      production-dependencies:
        dependency-type: "production"
        patterns:
          - "*"
    commit-message:
      prefix: "chore(deps)"

  # GitHub Actions
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    commit-message:
      prefix: "chore(ci)"

# .github/actions/setup-node-pnpm/action.yml
name: 'Setup Node + pnpm'
description: 'Common setup for Node.js projects with pnpm'

inputs:
  node-version:
    description: 'Node.js version'
    default: '20'
  install-deps:
    description: 'Run pnpm install'
    default: 'true'

runs:
  using: 'composite'
  steps:
    - uses: pnpm/action-setup@v4
      with:
        version: 9

    - uses: actions/setup-node@v4
      with:
        node-version: ${{ inputs.node-version }}
        cache: 'pnpm'

    - if: inputs.install-deps == 'true'
      run: pnpm install --frozen-lockfile
      shell: bash

- uses: ./.github/actions/setup-node-pnpm
  with:
    node-version: '20'

# .github/workflows/ci-reusable.yml
name: Reusable CI

on:
  workflow_call:
    inputs:
      node-version:
        type: string
        default: '20'
      run-e2e:
        type: boolean
        default: false
    secrets:
      NPM_TOKEN:
        required: false

jobs:
  lint-test-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/setup-node-pnpm
        with:
          node-version: ${{ inputs.node-version }}
      - run: pnpm lint && pnpm test && pnpm build

# Usage in other workflows:
# jobs:
#   ci:
#     uses: ./.github/workflows/ci-reusable.yml
#     with:
#       node-version: '20'

# AWS without secrets
permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789:role/github-actions
      aws-region: ap-northeast-1

# GCP without secrets
  - uses: google-github-actions/auth@v2
    with:
      workload_identity_provider: 'projects/123/locations/global/workloadIdentityPools/github/providers/github'
      service_account: 'github-actions@project.iam.gserviceaccount.com'

# Gitleaks (secret detection)
- uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# Trivy (vulnerability scan)
- uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'fs'
    severity: 'CRITICAL,HIGH'

// renovate.json
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended"],
  "schedule": ["before 6am on monday"],
  "timezone": "Asia/Tokyo",
  "labels": ["dependencies"],
  "packageRules": [
    {
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    },
    {
      "matchPackagePatterns": ["eslint", "prettier", "typescript"],
      "groupName": "linting"
    },
    {
      "matchPackagePatterns": ["@types/*"],
      "groupName": "type definitions"
    }
  ],
  "vulnerabilityAlerts": {
    "enabled": true,
    "labels": ["security"]
  }
}

# ============================================
# Stage 1: Dependencies
# ============================================
FROM node:20-alpine AS deps
RUN apk add --no-cache libc6-compat
WORKDIR /app

# Copy package files
COPY package.json pnpm-lock.yaml ./
RUN corepack enable pnpm && pnpm install --frozen-lockfile

# ============================================
# Stage 2: Builder
# ============================================
FROM node:20-alpine AS builder
WORKDIR /app

COPY --from=deps /app/node_modules ./node_modules
COPY . .

# Build application
RUN corepack enable pnpm && pnpm build

# ============================================
# Stage 3: Production
# ============================================
FROM node:20-alpine AS runner
WORKDIR /app

ENV NODE_ENV=production

# Security: Run as non-root user
RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 appuser

# Copy only necessary files
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./package.json

USER appuser

EXPOSE 3000
ENV PORT=3000

CMD ["node", "dist/index.js"]

# ============================================
# Base: Alpine with Node
# ============================================
FROM node:20-alpine AS base
RUN apk add --no-cache libc6-compat
RUN corepack enable pnpm

# ============================================
# Dependencies
# ============================================
FROM base AS deps
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN pnpm install --frozen-lockfile

# ============================================
# Builder
# ============================================
FROM base AS builder
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .

# Disable telemetry during build
ENV NEXT_TELEMETRY_DISABLED=1

RUN pnpm build

# ============================================
# Production Runner
# ============================================
FROM base AS runner
WORKDIR /app

ENV NODE_ENV=production
ENV NEXT_TELEMETRY_DISABLED=1

RUN addgroup --system --gid 1001 nodejs
RUN adduser --system --uid 1001 nextjs

# Copy public assets
COPY --from=builder /app/public ./public

# Set correct permissions for prerender cache
RUN mkdir .next
RUN chown nextjs:nodejs .next

# Copy standalone output
COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static

USER nextjs

EXPOSE 3000
ENV PORT=3000
ENV HOSTNAME="0.0.0.0"

CMD ["node", "server.js"]

# Build stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN corepack enable pnpm && pnpm install --frozen-lockfile
COPY . .
RUN pnpm build

# Production with distroless
FROM gcr.io/distroless/nodejs20-debian12
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./

EXPOSE 3000
CMD ["dist/index.js"]

# docker-compose.yml
version: '3.8'

services:
  app:
    build:
      context: .
      dockerfile: Dockerfile
      target: deps  # Stop at deps stage for dev
    volumes:
      - .:/app
      - /app/node_modules  # Anonymous volume for node_modules
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
      - DATABASE_URL=postgresql://user:pass@db:5432/mydb
    depends_on:
      db:
        condition: service_healthy
    command: pnpm dev

  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: user
      POSTGRES_PASSWORD: pass
      POSTGRES_DB: mydb
    volumes:
      - postgres_data:/var/lib/postgresql/data
    ports:
      - "5432:5432"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U user -d mydb"]
      interval: 5s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5

volumes:
  postgres_data:

node_modules
.pnpm-store
dist
.next
.git
.vscode
.env
.env.local
*.log
coverage
Dockerfile*
docker-compose*
.github

# syntax=docker/dockerfile:1.7

# Cache mount for package manager (reusable across builds)
FROM node:20-alpine AS deps
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN --mount=type=cache,target=/root/.local/share/pnpm/store \
    corepack enable pnpm && pnpm install --frozen-lockfile

# Parallel build stages
FROM deps AS build-app
COPY src ./src
RUN pnpm build

FROM deps AS build-assets
COPY public ./public
RUN pnpm build:assets

# Merge in final stage
FROM node:20-alpine AS runner
COPY --from=build-app /app/dist ./dist
COPY --from=build-assets /app/public ./public

# Docker Scout (CVE scan)
docker scout cves myimage:latest --only-severity critical,high

# Generate SBOM
docker scout sbom myimage:latest --format spdx-json > sbom.json

# CI integration
# - uses: docker/scout-action@v1
#   with:
#     command: cves
#     image: ${{ env.IMAGE }}
#     only-severities: critical,high
#     exit-code: true

# docker-compose.yml
services:
  app:
    build: .
    develop:
      watch:
        - action: sync
          path: ./src
          target: /app/src
        - action: rebuild
          path: package.json
        - action: sync+restart
          path: ./config
          target: /app/config

// src/lib/logger.ts
import pino from 'pino';

export const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  formatters: {
    level: (label) => ({ level: label }),
  },
  // Redact sensitive fields
  redact: ['req.headers.authorization', 'password', 'token', 'apiKey'],
  transport: process.env.NODE_ENV === 'development'
    ? { target: 'pino-pretty' }
    : undefined,
});

// Usage: logger.info({ userId, action }, 'User performed action');

// src/lib/logger.ts
import winston from 'winston';

export const logger = winston.createLogger({
  level: process.env.LOG_LEVEL || 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.errors({ stack: true }),
    winston.format.json()
  ),
  defaultMeta: { service: process.env.SERVICE_NAME },
  transports: [
    new winston.transports.Console({
      format: process.env.NODE_ENV === 'development'
        ? winston.format.simple()
        : winston.format.json(),
    }),
  ],
});

// src/routes/health.ts
import { Router } from 'express';
import { prisma } from '../lib/db';
import { redis } from '../lib/redis';

const router = Router();

interface HealthCheck {
  status: 'ok' | 'degraded' | 'unhealthy';
  timestamp: string;
  uptime: number;
  checks: {
    database: boolean;
    redis: boolean;
    memory: { used: number; total: number };
  };
}

router.get('/health', async (req, res) => {
  const checks = {
    database: await checkDatabase(),
    redis: await checkRedis(),
    memory: {
      used: process.memoryUsage().heapUsed,
      total: process.memoryUsage().heapTotal,
    },
  };

  const healthy = checks.database && checks.redis;
  const response: HealthCheck = {
    status: healthy ? 'ok' : 'degraded',
    timestamp: new Date().toISOString(),
    uptime: process.uptime(),
    checks,
  };

  res.status(healthy ? 200 : 503).json(response);
});

async function checkDatabase(): Promise<boolean> {
  try {
    await prisma.$queryRaw`SELECT 1`;
    return true;
  } catch {
    return false;
  }
}

async function checkRedis(): Promise<boolean> {
  try {
    await redis.ping();
    return true;
  } catch {
    return false;
  }
}

export { router as healthRouter };

// src/lib/sentry.ts
import * as Sentry from '@sentry/node';

export function initSentry() {
  if (!process.env.SENTRY_DSN) return;

  Sentry.init({
    dsn: process.env.SENTRY_DSN,
    environment: process.env.NODE_ENV,
    tracesSampleRate: process.env.NODE_ENV === 'production' ? 0.1 : 1.0,
    integrations: [
      Sentry.httpIntegration(),
      Sentry.expressIntegration(),
    ],
  });
}

// Express error handler
export const sentryErrorHandler = Sentry.expressErrorHandler();

// src/lib/metrics.ts
import { Registry, Counter, Histogram, collectDefaultMetrics } from 'prom-client';

export const register = new Registry();
collectDefaultMetrics({ register });

export const httpRequestsTotal = new Counter({
  name: 'http_requests_total',
  help: 'Total HTTP requests',
  labelNames: ['method', 'path', 'status'],
  registers: [register],
});

export const httpRequestDuration = new Histogram({
  name: 'http_request_duration_seconds',
  help: 'HTTP request duration',
  labelNames: ['method', 'path'],
  buckets: [0.01, 0.05, 0.1, 0.5, 1, 5],
  registers: [register],
});

// Middleware
export function metricsMiddleware(req, res, next) {
  const start = Date.now();
  res.on('finish', () => {
    const duration = (Date.now() - start) / 1000;
    httpRequestsTotal.inc({ method: req.method, path: req.route?.path || req.path, status: res.statusCode });
    httpRequestDuration.observe({ method: req.method, path: req.route?.path || req.path }, duration);
  });
  next();
}

// Endpoint: GET /metrics

# alertmanager/rules/app.yml
groups:
  - name: application
    rules:
      - alert: HighErrorRate
        expr: rate(http_requests_total{status=~"5.."}[5m]) / rate(http_requests_total[5m]) > 0.05
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "High error rate detected"
          description: "Error rate is {{ $value | humanizePercentage }} over last 5 minutes"

      - alert: HighLatency
        expr: histogram_quantile(0.95, rate(http_request_duration_seconds_bucket[5m])) > 1
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High latency detected"
          description: "p95 latency is {{ $value }}s"

      - alert: HealthCheckFailing
        expr: up{job="app"} == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Health check failing"

// src/lib/telemetry.ts
import { NodeSDK } from '@opentelemetry/sdk-node';
import { getNodeAutoInstrumentations } from '@opentelemetry/auto-instrumentations-node';
import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';

const sdk = new NodeSDK({
  traceExporter: new OTLPTraceExporter({
    url: process.env.OTEL_EXPORTER_OTLP_ENDPOINT || 'http://localhost:4318/v1/traces',
  }),
  instrumentations: [getNodeAutoInstrumentations()],
});

sdk.start();
process.on('SIGTERM', () => sdk.shutdown());

# 1. Check vulnerabilities
pnpm audit

# 2. Check for safe updates
pnpm outdated

# 3. Update within semver range (safe)
pnpm update

# 4. If specific package has vulnerability
pnpm update vulnerable-package

# 5. If major version required (ask first)
pnpm add vulnerable-package@latest

# 6. If transitive dependency
pnpm add vulnerable-package --save-dev
# or use overrides in package.json:
# "pnpm": {
#   "overrides": {
#     "vulnerable-package": "^2.0.0"
#   }
# }

# Check for unused dependencies
npx depcheck

# Check for outdated dependencies
pnpm outdated

# Check bundle size impact
npx bundlephobia-cli package-name

# Check for duplicate dependencies
pnpm dedupe --check

# List direct dependencies
pnpm list --depth=0

# Find why a package is installed
pnpm why package-name

# Check peer dependency issues
pnpm install --strict-peer-dependencies

# When lockfile conflicts occur:

# 1. Discard lockfile changes and regenerate
git checkout --theirs pnpm-lock.yaml  # or --ours
pnpm install

# 2. Or regenerate from scratch (last resort)
rm pnpm-lock.yaml
pnpm install

# 3. Verify build still works
pnpm build
pnpm test

{
  "dependencies": {
    // Exact: Most stable, manual updates required
    "critical-lib": "2.0.0",

    // Patch: Auto-update patch versions (recommended for most)
    "stable-lib": "~2.0.0",

    // Minor: Auto-update minor versions
    "flexible-lib": "^2.0.0",

    // Range: Explicit range
    "legacy-lib": ">=1.0.0 <2.0.0"
  },

  // Override transitive dependencies
  "pnpm": {
    "overrides": {
      "vulnerable-package": "^2.0.0",
      "package>nested-vulnerable": "^1.5.0"
    }
  }
}

# Install
curl -fsSL https://bun.sh/install | bash

# Basic commands (pnpm-like)
bun install              # Install dependencies
bun add <pkg>            # Add package
bun remove <pkg>         # Remove package
bun run <script>         # Run script
bun test                 # Run tests
bun build ./src/index.ts --outdir ./dist  # Bundle

# GitHub Actions with Bun
- uses: oven-sh/setup-bun@v2
  with:
    bun-version: latest

- run: bun install --frozen-lockfile
- run: bun test
- run: bun run build

# Python CI with uv
- uses: astral-sh/setup-uv@v4
- run: uv sync --frozen
- run: uv run pytest

# Go CI
- uses: actions/setup-go@v5
  with:
    go-version: '1.22'
- run: go mod download
- run: go test ./...

# pnpm-workspace.yaml
packages:
  - 'apps/*'
  - 'packages/*'
  - 'tools/*'

// Root package.json
{
  "name": "my-monorepo",
  "private": true,
  "scripts": {
    "build": "turbo build",
    "dev": "turbo dev",
    "lint": "turbo lint",
    "test": "turbo test",
    "clean": "turbo clean && rm -rf node_modules"
  },
  "devDependencies": {
    "turbo": "^2.0.0"
  },
  "packageManager": "pnpm@9.0.0"
}

// turbo.json
{
  "$schema": "https://turbo.build/schema.json",
  "globalDependencies": ["**/.env.*local"],
  "pipeline": {
    "build": {
      "dependsOn": ["^build"],
      "outputs": ["dist/**", ".next/**", "!.next/cache/**"]
    },
    "lint": {
      "dependsOn": ["^build"]
    },
    "test": {
      "dependsOn": ["build"],
      "outputs": ["coverage/**"],
      "inputs": ["src/**/*.tsx", "src/**/*.ts", "test/**/*.ts"]
    },
    "dev": {
      "cache": false,
      "persistent": true
    },
    "clean": {
      "cache": false
    }
  }
}

my-monorepo/
├── apps/
│   ├── web/                 # Next.js app
│   │   ├── package.json
│   │   └── ...
│   └── api/                 # Express/Fastify server
│       ├── package.json
│       └── ...
├── packages/
│   ├── ui/                  # Shared UI components
│   │   ├── package.json
│   │   ├── src/
│   │   └── tsconfig.json
│   ├── config/              # Shared configs (eslint, tsconfig)
│   │   ├── eslint/
│   │   └── typescript/
│   └── utils/               # Shared utilities
│       ├── package.json
│       └── src/
├── turbo.json
├── pnpm-workspace.yaml
├── package.json
└── pnpm-lock.yaml

// packages/ui/package.json
{
  "name": "@repo/ui",
  "version": "0.0.0",
  "private": true,
  "main": "./src/index.ts",
  "types": "./src/index.ts",
  "exports": {
    ".": "./src/index.ts",
    "./button": "./src/button.tsx",
    "./card": "./src/card.tsx"
  },
  "scripts": {
    "lint": "eslint src/",
    "build": "tsc"
  },
  "devDependencies": {
    "@repo/config": "workspace:*",
    "typescript": "^5.0.0"
  },
  "peerDependencies": {
    "react": "^18.0.0"
  }
}

// apps/web/package.json
{
  "name": "@repo/web",
  "version": "0.0.0",
  "private": true,
  "dependencies": {
    "@repo/ui": "workspace:*",
    "@repo/utils": "workspace:*"
  }
}

// packages/config/typescript/base.json
{
  "$schema": "https://json.schemastore.org/tsconfig",
  "display": "Base",
  "compilerOptions": {
    "strict": true,
    "esModuleInterop": true,
    "skipLibCheck": true,
    "forceConsistentCasingInFileNames": true,
    "moduleResolution": "bundler",
    "module": "ESNext",
    "target": "ES2022",
    "lib": ["ES2022"],
    "declaration": true,
    "declarationMap": true,
    "sourceMap": true,
    "isolatedModules": true
  },
  "exclude": ["node_modules"]
}

// packages/config/typescript/react.json
{
  "$schema": "https://json.schemastore.org/tsconfig",
  "display": "React",
  "extends": "./base.json",
  "compilerOptions": {
    "jsx": "react-jsx",
    "lib": ["ES2022", "DOM", "DOM.Iterable"]
  }
}

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2  # For turbo to detect changes

      - uses: pnpm/action-setup@v3
        with:
          version: 9

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - run: pnpm install --frozen-lockfile

      # Turbo remote caching
      - name: Build with Turbo
        run: pnpm build
        env:
          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
          TURBO_TEAM: ${{ vars.TURBO_TEAM }}

      # Only run affected tests
      - name: Test affected packages
        run: pnpm turbo test --filter='...[origin/main]'

# Install
pnpm add -D husky lint-staged
pnpm exec husky init
echo "pnpm exec lint-staged" > .husky/pre-commit

// package.json
{
  "lint-staged": {
    "*.{ts,tsx}": ["eslint --fix", "prettier --write"],
    "*.{json,md,yml}": ["prettier --write"]
  }
}

# lefthook.yml
pre-commit:
  parallel: true
  commands:
    lint:
      glob: "*.{ts,tsx}"
      run: pnpm eslint --fix {staged_files}
    format:
      glob: "*.{ts,tsx,json,md}"
      run: pnpm prettier --write {staged_files}

pre-push:
  commands:
    test:
      run: pnpm test --passWithNoTests

pnpm add -D @commitlint/cli @commitlint/config-conventional
echo "export default { extends: ['@commitlint/config-conventional'] };" > commitlint.config.js
echo "pnpm exec commitlint --edit \$1" > .husky/commit-msg

# Check why a package is installed
pnpm why <package>

# Find unused dependencies
npx depcheck

# Check for circular dependencies
npx madge --circular src/

# Verify lockfile integrity
pnpm install --frozen-lockfile

# Check bundle size
npx bundlephobia-cli <package>

# Docker layer analysis
docker history <image> --no-trunc

## HORIZON_HANDOFF

### Task: Dependency Modernization
- Outdated packages detected by: `pnpm outdated`
- Security issues detected by: `pnpm audit`

### Packages Requiring Attention
| Package | Current | Latest | Type |
|---------|---------|--------|------|
| [name] | [version] | [version] | [major/minor/security] |

### Request
1. Check if any packages are deprecated
2. Suggest modern alternatives if applicable
3. Provide migration guidance for breaking changes

## HORIZON_HANDOFF

### Task: Vulnerability Assessment
- Audit found: [number] vulnerabilities
- Critical: [count], High: [count], Moderate: [count]

### Details

### Request
1. Identify if vulnerable packages have modern replacements
2. Check if packages can be updated without breaking changes
3. Suggest migration path if major update required

## CANVAS_REQUEST

### Diagram Type: Flowchart
### Purpose: CI/CD Pipeline Visualization

### Pipeline Stages
1. Push to branch
2. Lint (parallel) → Test (parallel) → Type Check (parallel)
3. Build
4. Deploy to Staging (if main)
5. Manual approval
6. Deploy to Production

### Annotations
- Show parallel jobs
- Highlight cache usage points
- Mark environment gates

## CANVAS_REQUEST

### Diagram Type: Architecture Diagram
### Purpose: Container Architecture

### Components
- Multi-stage Dockerfile flow
- Layer caching strategy
- Volume mounts in development

### Show
- deps → builder → runner stages
- Size reduction between stages
- Security boundaries (non-root user)

## CANVAS_REQUEST

### Diagram Type: Dependency Graph
### Purpose: Monorepo Package Dependencies

### Packages
- @repo/web → @repo/ui, @repo/utils
- @repo/api → @repo/utils, @repo/db
- @repo/ui → (external: react)
- @repo/utils → (no deps)

### Show
- Internal dependencies (solid lines)
- External dependencies (dashed lines)
- Build order based on dependency graph

@Horizon - Dependency health check needed

Outdated packages: [list from pnpm outdated]
Audit issues: [count and severity]
Request: Modernization recommendations

@Canvas - DevOps documentation needed

Type: [CI/CD pipeline / Docker architecture / Dependency graph]
Components: [list of components]
Purpose: [documentation / onboarding / debugging]

@Radar - CI/CD tests needed

Pipeline: [workflow name]
Test coverage needed: [unit / integration / e2e]
Focus: [specific stage or job]

| YYYY-MM-DD | Gear | (action) | (files) | (outcome) |

_STEP_COMPLETE:
  Agent: Gear
  Status: SUCCESS | PARTIAL | BLOCKED | FAILED
  Output: [修正した設定ファイル / 更新した依存関係 / ビルド結果]
  Next: Radar | VERIFY | DONE

## NEXUS_HANDOFF
- Step: [X/Y]
- Agent: [AgentName]
- Summary: 1〜3行
- Key findings / decisions:
  - ...
- Artifacts (files/commands/links):
  - ...
- Risks / trade-offs:
  - ...
- Open questions (blocking/non-blocking):
  - ...
- Pending Confirmations:
  - Trigger: [INTERACTION_TRIGGER name if any]
  - Question: [Question for user]
  - Options: [Available options]
  - Recommended: [Recommended option]
- User Confirmations:
  - Q: [Previous question] → A: [User's answer]
- Suggested next agent: [AgentName]（理由）
- Next action: この返答全文をNexusに貼り付ける（他エージェントは呼ばない）