Skip to content

devops-infrastructure.md

Latest commit

 

History

History
198 lines (140 loc) · 4.83 KB

devops-infrastructure.md

File metadata and controls

198 lines (140 loc) · 4.83 KB
Raw

DevOps & DX Improvements Summary

Changes Made

1. mise.toml Enhancements

Added new tools for improved DX and DevSecOps:

New Tools Added:

  • oxlint - Fast JavaScript/TypeScript linter
  • typos - Fast spell checker for code and docs
  • shellcheck - Shell script linting
  • actionlint - GitHub Actions workflow validation
  • lefthook - Fast git hooks manager (Go-based alternative to husky)

New Tasks Added:

  • fmt-check - Check formatting without modifying files
  • security - Run all security checks in one command
  • security-trufflehog - Scan for secrets/credentials
  • security-snyk - Check dependency vulnerabilities
  • security-semgrep - SAST security scanning
  • security-dotenv - Lint .env files
  • spellcheck - Check for typos in code
  • shellcheck - Lint shell scripts
  • actionlint - Validate GitHub Actions workflows
  • hooks-install - Install lefthook git hooks
  • hooks-run - Manually run pre-commit hooks
  • audit - Comprehensive security + quality audit

2. package.json Updates

Added convenience scripts that map to mise tasks:

  • fmt:check - Formatting check
  • security - All security checks
  • security:secrets - Secret scanning
  • security:deps - Dependency vulnerabilities
  • security:sast - Static security analysis
  • security:env - .env file linting
  • spellcheck - Typo checking
  • audit - Full audit

3. turbo.json Updates

Added caching strategies for new tasks:

  • fmt:check - Cached based on source files
  • security:* - No cache (always run fresh)
  • spellcheck - Cached based on source files
  • audit - No cache, depends on security + spellcheck + check:all

4. New Configuration Files

Created:

  • _typos.toml - Configuration for typos spell checker
  • .trufflehog-exclude.txt - Exclusions for secret scanning
  • lefthook.yml - Git hooks configuration (commented, opt-in)
  • DEV_TOOLS.md - Comprehensive documentation

Benefits

Developer Experience (DX)

  1. Unified Tool Management - All tools managed by mise, no manual installs
  2. Fast Feedback - Tools like oxlint and typos are extremely fast
  3. Consistent Environment - Same tool versions across all developers
  4. Simple Commands - mise run <task> for everything
  5. Better Documentation - DEV_TOOLS.md provides clear guidance

DevSecOps

  1. Secret Detection - TruffleHog scans for leaked credentials
  2. Dependency Scanning - Snyk checks for vulnerable dependencies
  3. SAST - Semgrep performs static security analysis
  4. Configuration Validation - dotenv-linter checks .env files
  5. CI/CD Ready - All tools work in pipelines

Code Quality

  1. Spell Checking - Typos catches typos in code/docs (very fast)
  2. Shell Script Linting - Shellcheck validates bash/zsh scripts
  3. Workflow Validation - Actionlint checks GitHub Actions

Usage Examples

Daily Development

# Start working
mise run dev

# Before committing
mise run check-all

# Run security audit
mise run audit

Security Focused

# Full security scan
mise run security

# Individual scans
mise run security-trufflehog  # Secrets
mise run security-snyk        # Dependencies
mise run security-semgrep     # SAST
mise run security-dotenv      # .env files

Quality Checks

# Spell check
mise run spellcheck

# Shell scripts
mise run shellcheck

# GitHub workflows
mise run actionlint

Migration Path

Optional: Switch to Lefthook (from Husky)

Lefthook is faster and more feature-rich than husky:

  1. Edit lefthook.yml - Uncomment the hooks you want
  2. Run mise run hooks-install
  3. Remove "prepare": "husky" from package.json
  4. Optional: Remove husky dependency

Benefits of lefthook:

  • 10x faster than husky (written in Go)
  • Parallel execution of hooks
  • Skip options for specific scenarios
  • Better error handling

Next Steps

  1. Install New Tools:

    mise install

  2. Test Security Scans:

    mise run security

  3. Try Audit:

    mise run audit

  4. Update CI/CD: Add security and audit tasks to your CI pipeline

  5. Team Onboarding: Share DEV_TOOLS.md with team members

Performance Notes

  • typos - Checks entire codebase in < 100ms
  • oxlint - 50-100x faster than ESLint
  • lefthook - 10x faster than husky
  • mise - Parallel task execution with mise run
  • turbo - Intelligent caching for repeated tasks

Compatibility

All tools are:

  • ✅ macOS compatible
  • ✅ Linux compatible
  • ✅ Windows compatible (via WSL)
  • ✅ CI/CD compatible
  • ✅ VS Code integrated

Configuration Customization

All tools can be customized:

  • _typos.toml - Add project-specific words
  • .trufflehog-exclude.txt - Exclude files from secret scanning
  • lefthook.yml - Configure git hooks
  • semgrep.yml - Add custom security rules
  • mise.toml - Modify tasks and tool versions