Vorlagenbibliothek für Devin-Blueprints

initialize: |
  npm install -g pnpm

maintenance: |
  pnpm install

knowledge:
  - name: lint
    contents: |
      Führen Sie `pnpm lint` aus, um auf Fehler zu prüfen.
  - name: test
    contents: |
      Führen Sie `pnpm test` für die vollständige Testsuite aus.

initialize: |
  curl -LsSf https://astral.sh/uv/install.sh | sh

maintenance: |
  uv sync

knowledge:
  - name: lint
    contents: |
      Führen Sie `uv run ruff check .` zum Linten aus.
  - name: test
    contents: |
      Führen Sie `uv run pytest` für die vollständige Testsuite aus.

initialize:
  - name: pnpm installieren
    run: npm install -g pnpm
  - name: Install uv
    run: curl -LsSf https://astral.sh/uv/install.sh | sh

maintenance:
  - name: Frontend-Abhängigkeiten
    run: (cd frontend && pnpm install)
  - name: Backend-Abhängigkeiten
    run: (cd backend && uv sync)

knowledge:
  - name: structure
    contents: |
      - `frontend/` — React-App (pnpm)
      - `backend/` — Python-API (uv)
  - name: test
    contents: |
      Frontend: cd frontend && pnpm test
      Backend: cd backend && uv run pytest

initialize:
  - name: Install Go
    run: |
      GO_VERSION=1.23.5
      ARCH=$(dpkg --print-architecture)
      curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-${ARCH}.tar.gz" \
        | sudo tar -xz -C /usr/local
      echo 'export PATH="/usr/local/go/bin:$HOME/go/bin:$PATH"' \
        | sudo tee /etc/profile.d/golang.sh > /dev/null

  - name: Configure Go for private modules
    run: |
      cat << 'GOENV' | sudo tee /etc/profile.d/go-private.sh > /dev/null
      export GOPROXY="$GO_PROXY_URL,direct"
      export GONOSUMCHECK="corp.internal/*,github.com/myorg/*"
      export GOPRIVATE="corp.internal/*,github.com/myorg/*"
      GOENV

knowledge:
  - name: private_go_modules
    contents: |
      From the repository root, with GO_PROXY_URL available, run:
        source /etc/profile.d/go-private.sh && go mod download

initialize:
  - name: Install .NET SDK
    run: |
      curl -fsSL https://dot.net/v1/dotnet-install.sh | bash -s -- --channel 8.0
      echo 'export PATH="$HOME/.dotnet:$PATH"' \
        | sudo tee /etc/profile.d/dotnet.sh > /dev/null

maintenance:
  - name: Configure NuGet for private feed
    run: |
      dotnet nuget add source "$NUGET_SOURCE_URL" \
        --name private 2>/dev/null || \
      dotnet nuget update source private \
        --source "$NUGET_SOURCE_URL"

knowledge:
  - name: private_nuget_packages
    contents: |
      Run dotnet restore with NuGetPackageSourceCredentials_private in its
      environment. The suffix must match the source name "private".

initialize:
  - name: Create Docker config directory
    run: sudo mkdir -p /etc/docker

maintenance:
  - name: Configure Docker for private registry
    run: |
      # Registry-Mirror konfigurieren (optional – leitet Docker-Hub-Pulls über Ihre Registry)
      cat << EOF | sudo tee /etc/docker/daemon.json > /dev/null
      {
        "registry-mirrors": ["$DOCKER_MIRROR_URL"]
      }
      EOF
      sudo systemctl restart docker || true

knowledge:
  - name: private_container_images
    contents: |
      With the registry secrets available, run this in one shell.
      Replace team/image:tag with the image to pull:
        (
          set -euo pipefail
          umask 077
          DOCKER_CONFIG=$(mktemp -d)
          export DOCKER_CONFIG
          trap 'rm -rf "$DOCKER_CONFIG"' EXIT
          printf '%s' "$DOCKER_REGISTRY_PASS" |
            docker login "$DOCKER_REGISTRY_URL" \
              --username "$DOCKER_REGISTRY_USER" --password-stdin
          docker pull "$DOCKER_REGISTRY_URL/team/image:tag"
        )

initialize:
  - name: Install Rust
    run: |
      curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
        | sh -s -- -y --default-toolchain stable
      echo 'source "$HOME/.cargo/env"' \
        | sudo tee /etc/profile.d/rust.sh > /dev/null

maintenance:
  - name: Configure Cargo for private registry
    run: |
      mkdir -p ~/.cargo
      cat > ~/.cargo/config.toml << EOF
      [registry]
      global-credential-providers = ["cargo:token"]

      [registries.private]
      index = "$CARGO_REGISTRY_INDEX"

      [source.crates-io]
      replace-with = "private"

      [source.private]
      registry = "$CARGO_REGISTRY_INDEX"
      EOF

knowledge:
  - name: private_rust_packages
    contents: |
      Run cargo fetch with CARGO_REGISTRIES_PRIVATE_TOKEN in its environment.

initialize:
  - name: Install Ruby
    run: |
      sudo apt-get update -qq
      sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq ruby-full

maintenance:
  - name: Configure Bundler for private gem server
    run: |
      bundle config set mirror.https://rubygems.org "$GEM_SERVER_URL"

knowledge:
  - name: private_ruby_packages
    contents: |
      Run bundle install with BUNDLE_ARTIFACTORY__EXAMPLE__COM in its environment.

initialize:
  - name: Install PHP and Composer
    run: |
      sudo apt-get update -qq
      sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
        php-cli php-mbstring php-xml php-curl unzip

      # Composer installieren
      curl -sS https://getcomposer.org/installer | php
      sudo mv composer.phar /usr/local/bin/composer

maintenance:
  - name: Configure Composer for private registry
    run: |
      composer config --global repositories.private \
        composer "$COMPOSER_REGISTRY_URL"

knowledge:
  - name: private_php_packages
    contents: |
      Run composer install with COMPOSER_AUTH in its environment.
      Do not save these credentials to auth.json.

maintenance:
  - name: Configure CodeArtifact clients and refresh script
    run: |
      mkdir -p ~/.config
      cat > ~/.config/codeartifact.sh <<'SCRIPT'
      CODEARTIFACT_AUTH_TOKEN=$(aws codeartifact get-authorization-token \
        --domain "$CA_DOMAIN" \
        --domain-owner "$CA_DOMAIN_OWNER" \
        --region "$CA_REGION" \
        --query authorizationToken \
        --output text) || return
      export CODEARTIFACT_AUTH_TOKEN
      export CA_ENDPOINT="https://${CA_DOMAIN}-${CA_DOMAIN_OWNER}.d.codeartifact.${CA_REGION}.amazonaws.com"
      export PIP_INDEX_URL="https://aws:${CODEARTIFACT_AUTH_TOKEN}@${CA_DOMAIN}-${CA_DOMAIN_OWNER}.d.codeartifact.${CA_REGION}.amazonaws.com/pypi/${CA_PYPI_REPO}/simple/"
      SCRIPT

      # npm konfigurieren
      npm config set registry '${CA_ENDPOINT}/npm/${CA_NPM_REPO}/'
      npm config set "//${CA_DOMAIN}-${CA_DOMAIN_OWNER}.d.codeartifact.${CA_REGION}.amazonaws.com/npm/${CA_NPM_REPO}/:_authToken" '${CODEARTIFACT_AUTH_TOKEN}'

      # Maven konfigurieren (optional)
      mkdir -p ~/.m2
      cat > ~/.m2/settings.xml <<'EOF'
      <settings>
        <servers>
          <server>
            <id>codeartifact</id>
            <username>aws</username>
            <password>${env.CODEARTIFACT_AUTH_TOKEN}</password>
          </server>
        </servers>
        <mirrors>
          <mirror>
            <id>codeartifact</id>
            <mirrorOf>*</mirrorOf>
            <url>${env.CA_ENDPOINT}/maven/${env.CA_MAVEN_REPO}/</url>
          </mirror>
        </mirrors>
      </settings>
      EOF

knowledge:
  - name: codeartifact_packages
    contents: |
      With AWS credentials and the CA_* variables available, run the appropriate
      command in one shell; source the script again for later invocations:
        source ~/.config/codeartifact.sh && npm install
        source ~/.config/codeartifact.sh && pip install -r requirements.txt
        source ~/.config/codeartifact.sh && mvn dependency:resolve

initialize:
  - name: Install corporate CA certificate
    run: |
      set -o pipefail
      printf '%s' "$CORP_ROOT_CA_B64" | base64 -d | openssl x509 -outform PEM \
        | sudo tee /usr/local/share/ca-certificates/corp-root-ca.crt > /dev/null
      sudo update-ca-certificates
      echo 'export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt' \
        | sudo tee /etc/profile.d/node-ca.sh > /dev/null

initialize:
  - name: Install corporate CA certificates
    run: |
      set -o pipefail
      printf '%s' "$CORP_ROOT_CA_B64" | base64 -d | openssl x509 -outform PEM \
        | sudo tee /usr/local/share/ca-certificates/corp-root-ca.crt > /dev/null
      printf '%s' "$CORP_INTERMEDIATE_CA_B64" | base64 -d | openssl x509 -outform PEM \
        | sudo tee /usr/local/share/ca-certificates/corp-intermediate-ca.crt > /dev/null
      sudo update-ca-certificates

      # Kombiniertes Bundle für Tools erstellen, die eine einzelne CA-Datei benötigen
      cat /usr/local/share/ca-certificates/corp-*.crt \
        | sudo tee /usr/local/share/ca-certificates/corp-bundle.crt > /dev/null

      echo 'export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-bundle.crt' \
        | sudo tee /etc/profile.d/node-ca.sh > /dev/null

initialize:
  - name: Configure system-wide proxy
    run: |
      cat << 'PROXY' | sudo tee /etc/profile.d/proxy.sh > /dev/null
      export http_proxy="$CORP_HTTP_PROXY"
      export https_proxy="$CORP_HTTPS_PROXY"
      export no_proxy="$CORP_NO_PROXY"
      export HTTP_PROXY="$CORP_HTTP_PROXY"
      export HTTPS_PROXY="$CORP_HTTPS_PROXY"
      export NO_PROXY="$CORP_NO_PROXY"
      PROXY
      source /etc/profile.d/proxy.sh

knowledge:
  - name: proxy_commands
    contents: |
      With CORP_HTTP_PROXY, CORP_HTTPS_PROXY and CORP_NO_PROXY available, source
      the proxy setup in each command that needs it, for example:
        source /etc/profile.d/proxy.sh && npm install
        source /etc/profile.d/proxy.sh && git fetch

initialize:
  - name: Configure authenticated proxy
    run: |
      cat <<'PROXY' | sudo tee /etc/profile.d/proxy.sh > /dev/null
      export http_proxy="http://${PROXY_USER}:${PROXY_PASS}@${PROXY_HOST}"
      export https_proxy="$http_proxy"
      export no_proxy="$CORP_NO_PROXY"
      export HTTP_PROXY="$http_proxy"
      export HTTPS_PROXY="$https_proxy"
      export NO_PROXY="$CORP_NO_PROXY"
      PROXY
      source /etc/profile.d/proxy.sh

knowledge:
  - name: authenticated_proxy_commands
    contents: |
      With the proxy secrets available, source the proxy setup in the same
      command as each tool that needs it, for example:
        source /etc/profile.d/proxy.sh && git fetch

initialize:
  - name: Install corporate CA certificate
    run: |
      set -o pipefail
      printf '%s' "$CORP_ROOT_CA_B64" | base64 -d | openssl x509 -outform PEM \
        | sudo tee /usr/local/share/ca-certificates/corp-root-ca.crt > /dev/null
      sudo update-ca-certificates
      echo 'export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt' \
        | sudo tee /etc/profile.d/node-ca.sh > /dev/null

  - name: Configure system-wide proxy
    run: |
      cat << 'PROXY' | sudo tee /etc/profile.d/proxy.sh > /dev/null
      export http_proxy="$CORP_HTTP_PROXY"
      export https_proxy="$CORP_HTTPS_PROXY"
      export no_proxy="$CORP_NO_PROXY"
      export HTTP_PROXY="$CORP_HTTP_PROXY"
      export HTTPS_PROXY="$CORP_HTTPS_PROXY"
      export NO_PROXY="$CORP_NO_PROXY"
      PROXY
      source /etc/profile.d/proxy.sh

knowledge:
  - name: proxy_commands
    contents: |
      With the proxy secrets available, run:
        source /etc/profile.d/proxy.sh && git fetch

initialize:
  - name: Install OpenVPN
    run: |
      sudo DEBIAN_FRONTEND=noninteractive apt-get update -qq
      sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq openvpn

(
  set -euo pipefail
  umask 077
  VPN_DIR=$(mktemp -d)
  cleanup() {
    if [ -f "$VPN_DIR/openvpn.pid" ]; then
      sudo kill "$(cat "$VPN_DIR/openvpn.pid")" || true
    fi
    sudo rm -rf "$VPN_DIR"
  }
  trap cleanup EXIT
  printf '%s' "$VPN_CONFIG_B64" | base64 -d > "$VPN_DIR/corp.conf"
  if [ -n "${VPN_AUTH_USER:-}" ] && [ -n "${VPN_AUTH_PASS:-}" ]; then
    printf '%s\n%s\n' "$VPN_AUTH_USER" "$VPN_AUTH_PASS" > "$VPN_DIR/auth.txt"
    printf 'auth-user-pass %s/auth.txt\n' "$VPN_DIR" >> "$VPN_DIR/corp.conf"
  fi
  sudo openvpn --config "$VPN_DIR/corp.conf" \
    --writepid "$VPN_DIR/openvpn.pid" --daemon
  for i in $(seq 1 30); do
    if ip link show tun0 >/dev/null 2>&1; then break; fi
    sleep 1
  done
  ip link show tun0 >/dev/null
  curl --fail https://service.corp.internal/health
)

initialize:
  - name: Install WireGuard
    run: |
      sudo DEBIAN_FRONTEND=noninteractive apt-get update -qq
      sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq wireguard-tools

(
  set -euo pipefail
  umask 077
  VPN_DIR=$(mktemp -d)
  cleanup() {
    sudo wg-quick down "$VPN_DIR/corp.conf" || true
    sudo rm -rf "$VPN_DIR"
  }
  trap cleanup EXIT
  printf '%s' "$WG_CONFIG_B64" | base64 -d > "$VPN_DIR/corp.conf"
  sudo wg-quick up "$VPN_DIR/corp.conf"
  curl --fail https://service.corp.internal/health
)

initialize:
  - name: Configure custom DNS resolution
    run: |
      # Interne Hostnamen hinzufügen
      cat << 'HOSTS' | sudo tee -a /etc/hosts > /dev/null
      10.0.1.50  nexus.corp.internal
      10.0.1.51  git.corp.internal
      10.0.1.52  artifactory.corp.internal
      HOSTS

      # Optional benutzerdefinierte Nameserver konfigurieren
      sudo mkdir -p /etc/systemd/resolved.conf.d
      cat << 'DNS' | sudo tee /etc/systemd/resolved.conf.d/corp.conf > /dev/null
      [Resolve]
      DNS=10.0.0.53 10.0.0.54
      Domains=corp.internal
      DNS
      sudo systemctl restart systemd-resolved || true

(
  set -euo pipefail
  umask 077
  GNUPGHOME=$(mktemp -d)
  export GNUPGHOME
  trap 'gpgconf --kill gpg-agent; rm -rf "$GNUPGHOME"' EXIT
  printf '%s' "$GPG_PRIVATE_KEY_B64" | base64 -d | gpg --batch --import
  git -c user.name="$GIT_USER_NAME" -c user.email="$GIT_USER_EMAIL" \
    -c user.signingkey="$GPG_SIGNING_KEY" -c commit.gpgsign=true \
    -c gpg.program=gpg commit -m "Describe the change"
)

initialize:
  - name: Configure git identity
    run: |
      git config --global user.name "$GIT_USER_NAME"
      git config --global user.email "$GIT_USER_EMAIL"

(
  set -euo pipefail
  umask 077
  SSH_DIR=$(mktemp -d)
  trap 'rm -rf "$SSH_DIR"' EXIT
  printf '%s' "$SSH_PRIVATE_KEY_B64" | base64 -d > "$SSH_DIR/id_ed25519"
  printf '%s' "$SSH_KNOWN_HOSTS_B64" | base64 -d > "$SSH_DIR/known_hosts"
  export GIT_SSH_COMMAND="ssh -F /dev/null -i '$SSH_DIR/id_ed25519' -o IdentitiesOnly=yes -o UserKnownHostsFile='$SSH_DIR/known_hosts' -o StrictHostKeyChecking=yes"
  git ls-remote git@git.corp.internal:team/repo.git
)

initialize:
  - name: Install system packages
    run: |
      sudo apt-get update -qq
      sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
        libpq-dev \
        libmagickwand-dev \
        poppler-utils \
        ffmpeg

initialize:
  - name: Benutzerdefinierte Umgebungsvariablen festlegen
    run: |
      echo "CORPORATE_ENV=production" >> $ENVRC
      echo "DEFAULT_REGION=us-east-1" >> $ENVRC
      echo "MAX_RETRIES=3" >> $ENVRC

initialize:
  - name: Configure locale and timezone
    run: |
      sudo DEBIAN_FRONTEND=noninteractive apt-get update -qq
      sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq locales

      # Locale generieren und festlegen
      sudo sed -i 's/^# *en_US.UTF-8/en_US.UTF-8/' /etc/locale.gen
      sudo locale-gen
      sudo update-locale LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8

      cat << 'LOCALE' | sudo tee /etc/profile.d/locale.sh > /dev/null
      export LANG="en_US.UTF-8"
      export LC_ALL="en_US.UTF-8"
      LOCALE

      # Zeitzone festlegen
      sudo timedatectl set-timezone UTC 2>/dev/null || \
        sudo ln -sfn /usr/share/zoneinfo/UTC /etc/localtime

initialize:
  - name: Raise resource limits
    run: |
      cat << 'LIMITS' | sudo tee /etc/security/limits.d/99-devin.conf > /dev/null
      *    soft    nofile    65536
      *    hard    nofile    65536
      *    soft    nproc     65536
      *    hard    nproc     65536
      LIMITS

      # Auch das Kernel-Maximum setzen
      echo "fs.file-max = 65536" | sudo tee /etc/sysctl.d/99-devin-filemax.conf > /dev/null
      sudo sysctl -p /etc/sysctl.d/99-devin-filemax.conf 2>/dev/null || true

initialize:
  - name: Replace APT sources with internal mirror
    run: |
      # Originale Quellen sichern
      sudo cp /etc/apt/sources.list /etc/apt/sources.list.bak

      # Alle Ubuntu-Mirrors durch den internen Mirror ersetzen
      sudo sed -i "s|http://archive.ubuntu.com/ubuntu|$APT_MIRROR_URL|g" /etc/apt/sources.list
      sudo sed -i "s|http://security.ubuntu.com/ubuntu|$APT_MIRROR_URL|g" /etc/apt/sources.list

      sudo apt-get update -qq

initialize: |
  cat <<'EOF' > .envrc
  export DATABASE_URL=postgresql://localhost:5432/myapp_dev
  export REDIS_URL=redis://localhost:6379
  export APP_ENV=development
  EOF

maintenance: |
  direnv allow .

initialize: |
  nvm install 18
  nvm install 20
  nvm install 22

maintenance: |
  nvm use

initialize: |
  pip install playwright
  playwright install chromium

maintenance: |
  npm install

knowledge:
  - name: browser-auth
    contents: |
      This project requires browser authentication.
      Run the login script before interacting with the app:
      python scripts/login.py

      Devin's Chrome browser is accessible via CDP at:
      http://localhost:29229

from playwright.sync_api import sync_playwright
import os

with sync_playwright() as p:
    browser = p.chromium.connect_over_cdp("http://localhost:29229")
    context = browser.contexts[0]
    page = context.pages[0] if context.pages else context.new_page()

    page.goto("https://internal-tool.example.com/login")
    page.fill("#username", os.environ["TOOL_USERNAME"])
    page.fill("#password", os.environ["TOOL_PASSWORD"])
    page.click('button[type="submit"]')
    page.wait_for_url("**/dashboard")

initialize:
  - name: Install system packages
    run: |
      apt-get update
      apt-get install -y \
        jq \
        ripgrep \
        fd-find \
        protobuf-compiler \
        libssl-dev

  - name: Install custom CLI tool
    run: |
      curl -L https://github.com/example/tool/releases/download/v1.0/tool-linux-amd64 \
        -o /usr/local/bin/mytool
      chmod +x /usr/local/bin/mytool

  - name: Add custom bin directory to PATH
    run: |
      mkdir -p ~/bin
      echo 'export PATH="$HOME/bin:$PATH"' >> ~/.bashrc

knowledge:
  - name: tools
    contents: |
      Custom tools available:
      - mytool: installed at /usr/local/bin/mytool
      - Additional binaries can be placed in ~/bin

initialize:
  - name: "Install Node.js 20"
    uses: github.com/actions/setup-node@v4
    with:
      node-version: "20"

  - name: "Install Python 3.12"
    uses: github.com/actions/setup-python@v5
    with:
      python-version: "3.12"

  - name: "Install Go 1.22"
    uses: github.com/actions/setup-go@v5
    with:
      go-version: "1.22"

  - name: "Install Java 21"
    uses: github.com/actions/setup-java@v4
    with:
      java-version: "21"
      distribution: "temurin"

  - name: "Install Gradle"
    uses: github.com/gradle/actions/setup-gradle@v4

  - name: "Install Ruby 3.3"
    uses: github.com/ruby/setup-ruby@v1
    with:
      ruby-version: "3.3"

  - name: "Install additional tools"
    run: |
      pip install uv
      npm install -g pnpm turbo
      go install golang.org/x/tools/gopls@latest

maintenance: |
  echo "All runtimes are available:"
  node --version
  python --version
  go version
  java --version

initialize:
  - name: Install Caddy and NSS tools
    run: |
      sudo apt-get install -y debian-keyring debian-archive-keyring \
        apt-transport-https curl libnss3-tools
      curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
        | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
      curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
        | sudo tee /etc/apt/sources.list.d/caddy-stable.list
      sudo apt-get update -qq
      sudo apt-get install -y caddy

  - name: Install Caddyfile, hosts entries, and trust internal CA
    run: |
      sudo install -m 0644 "$FILE_CADDYFILE" /etc/caddy/Caddyfile

      for host in app.example.com api.example.com admin.example.com; do
        grep -q " $host$" /etc/hosts \
          || echo "127.0.0.1 $host" | sudo tee -a /etc/hosts > /dev/null
      done

      sudo systemctl enable --now caddy
      sudo caddy trust

      mkdir -p ~/.pki/nssdb
      [ -f ~/.pki/nssdb/cert9.db ] \
        || certutil -d sql:$HOME/.pki/nssdb -N --empty-password

      CADDY_ROOT=/var/lib/caddy/.local/share/caddy/pki/authorities/local/root.crt
      for _ in $(seq 1 30); do
        sudo test -f "$CADDY_ROOT" && break
        sleep 1
      done

      if sudo test -f "$CADDY_ROOT" \
         && ! certutil -d sql:$HOME/.pki/nssdb -L | grep -q "Caddy Local Authority"; then
        sudo install -o "$USER" -m 0644 "$CADDY_ROOT" /tmp/caddy-root.crt
        certutil -d sql:$HOME/.pki/nssdb -A -t "C,," \
          -n "Caddy Local Authority" -i /tmp/caddy-root.crt
        rm -f /tmp/caddy-root.crt
      fi

initialize:
  # ── Kontoweit: Netzwerk und Vertrauen ────────────────────────────────────

  - name: Install corporate CA certificate
    run: |
      set -o pipefail
      printf '%s' "$CORP_ROOT_CA_B64" | base64 -d | openssl x509 -outform PEM \
        | sudo tee /usr/local/share/ca-certificates/corp-root-ca.crt > /dev/null
      sudo update-ca-certificates
      echo 'export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt' \
        | sudo tee /etc/profile.d/node-ca.sh > /dev/null

  - name: Configure system-wide proxy
    run: |
      cat << 'PROXY' | sudo tee /etc/profile.d/proxy.sh > /dev/null
      export http_proxy="$CORP_HTTP_PROXY"
      export https_proxy="$CORP_HTTPS_PROXY"
      export no_proxy="$CORP_NO_PROXY"
      export HTTP_PROXY="$CORP_HTTP_PROXY"
      export HTTPS_PROXY="$CORP_HTTPS_PROXY"
      export NO_PROXY="$CORP_NO_PROXY"
      PROXY
      source /etc/profile.d/proxy.sh

  # ── Organisationsweit: Language Runtimes ─────────────────────────────────

  - name: Install JDK 17 + Maven
    run: |
      set -o pipefail
      source /etc/profile.d/proxy.sh
      sudo --preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY \
        apt-get update -qq
      sudo --preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY \
        DEBIAN_FRONTEND=noninteractive apt-get install -y -qq openjdk-17-jdk-headless
      echo 'export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64' \
        | sudo tee /etc/profile.d/java.sh > /dev/null

      MAVEN_VERSION=3.9.9
      curl -fsSL "https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz" \
        | sudo tar -xz -C /opt
      sudo ln -sf /opt/apache-maven-${MAVEN_VERSION}/bin/mvn /usr/local/bin/mvn

  - name: Install uv
    run: |
      set -o pipefail
      source /etc/profile.d/proxy.sh
      curl -LsSf https://astral.sh/uv/install.sh | sh

maintenance:
  # ── Organisationsweit: Registry-Konfiguration ──────────────────────────

  - name: Configure Maven → Artifactory
    run: |
      mkdir -p ~/.m2
      cat > ~/.m2/settings.xml <<'EOF'
      <settings>
        <mirrors>
          <mirror>
            <id>artifactory</id>
            <mirrorOf>*</mirrorOf>
            <url>${env.ARTIFACTORY_MAVEN_URL}</url>
          </mirror>
        </mirrors>
        <servers>
          <server>
            <id>artifactory</id>
            <username>${env.ARTIFACTORY_USER}</username>
            <password>${env.ARTIFACTORY_TOKEN}</password>
          </server>
        </servers>
      </settings>
      EOF

  - name: Configure pip/uv → Artifactory PyPI
    run: |
      mkdir -p ~/.config
      cat > ~/.config/private-pypi.sh <<'EOF'
      export PIP_INDEX_URL="$ARTIFACTORY_PYPI_URL"
      export UV_INDEX_URL="$ARTIFACTORY_PYPI_URL"
      EOF

  - name: Configure npm → Artifactory
    run: |
      npm config set registry '${ARTIFACTORY_NPM_URL}'
      REGISTRY_HOST=$(echo "$ARTIFACTORY_NPM_URL" | sed 's|https\?://||;s|/.*||')
      npm config set "//${REGISTRY_HOST}/:_authToken" '${ARTIFACTORY_TOKEN}'

knowledge:
  - name: private_packages
    contents: |
      With the corresponding secrets available, source setup in each command:
        source /etc/profile.d/proxy.sh && mvn dependency:resolve
        source /etc/profile.d/proxy.sh && npm install
        source /etc/profile.d/proxy.sh && source ~/.config/private-pypi.sh && uv sync
  - name: private_container_images
    contents: |
      With the Artifactory and proxy secrets available, run in one shell.
      Replace team/image:tag with the image to pull:
        (
          set -euo pipefail
          umask 077
          source /etc/profile.d/proxy.sh
          DOCKER_CONFIG=$(mktemp -d)
          export DOCKER_CONFIG
          trap 'rm -rf "$DOCKER_CONFIG"' EXIT
          printf '%s' "$ARTIFACTORY_TOKEN" |
            docker login "$ARTIFACTORY_DOCKER_URL" \
              --username "$ARTIFACTORY_USER" --password-stdin
          docker pull "$ARTIFACTORY_DOCKER_URL/team/image:tag"
        )

maintenance:
  # Maven → Nexus
  - name: Configure Maven → Nexus
    run: |
      mkdir -p ~/.m2
      cat > ~/.m2/settings.xml <<'EOF'
      <settings>
        <mirrors>
          <mirror>
            <id>nexus</id>
            <mirrorOf>*</mirrorOf>
            <url>${env.NEXUS_MAVEN_URL}</url>
          </mirror>
        </mirrors>
        <servers>
          <server>
            <id>nexus</id>
            <username>${env.NEXUS_USER}</username>
            <password>${env.NEXUS_PASS}</password>
          </server>
        </servers>
      </settings>
      EOF

  # npm → GitHub Packages (mit Scope)
  - name: Configure npm → GitHub Packages
    run: |
      npm config set @myorg:registry https://npm.pkg.github.com
      npm config set //npm.pkg.github.com/:_authToken '${GITHUB_PACKAGES_TOKEN}'

  # Python → Artifactory
  - name: Configure pip → Artifactory
    run: |
      mkdir -p ~/.config
      cat > ~/.config/private-pypi.sh <<'EOF'
      export PIP_INDEX_URL="https://$ARTIFACTORY_USER:$ARTIFACTORY_TOKEN@artifactory.example.com/artifactory/api/pypi/pypi-virtual/simple"
      EOF

  # Go → private Module über den verbundenen Git-Anbieter
  - name: Configure Go private modules
    run: |
      go env -w GOPRIVATE=github.com/myorg/*

knowledge:
  - name: private_python_packages
    contents: |
      With URL-encoded ARTIFACTORY_USER and ARTIFACTORY_TOKEN available, run:
        source ~/.config/private-pypi.sh && pip install -r requirements.txt

initialize:
  - name: Install corporate CA certificate
    run: |
      set -o pipefail
      printf '%s' "$CORP_ROOT_CA_B64" | base64 -d | openssl x509 -outform PEM \
        | sudo tee /usr/local/share/ca-certificates/corp-root-ca.crt > /dev/null
      sudo update-ca-certificates

  - name: Replace apt sources with internal mirror
    run: |
      sudo sed -i "s|http://archive.ubuntu.com/ubuntu|$APT_MIRROR_URL|g" /etc/apt/sources.list
      sudo sed -i "s|http://security.ubuntu.com/ubuntu|$APT_MIRROR_URL|g" /etc/apt/sources.list
      sudo apt-get update -qq

  - name: Install JDK from internal mirror
    run: |
      # JDK-Tarball aus internem Artefakt-Store herunterladen
      curl -fsSL -u "$MIRROR_USER:$MIRROR_PASS" "$JDK_TARBALL_URL" \
        | sudo tar -xz -C /usr/local
      sudo ln -sf /usr/local/jdk-17.*/bin/java /usr/local/bin/java
      sudo ln -sf /usr/local/jdk-17.*/bin/javac /usr/local/bin/javac
      echo "export JAVA_HOME=$(ls -d /usr/local/jdk-17.*)" \
        | sudo tee /etc/profile.d/java.sh > /dev/null

  - name: Install Node.js from internal mirror
    run: |
      curl -fsSL -u "$MIRROR_USER:$MIRROR_PASS" "$NODE_TARBALL_URL" \
        | sudo tar -xz -C /usr/local --strip-components=1

maintenance:
  - name: Configure all package managers for internal registry
    run: |
      # Maven
      mkdir -p ~/.m2
      cat > ~/.m2/settings.xml <<'EOF'
      <settings>
        <mirrors>
          <mirror>
            <id>internal</id>
            <mirrorOf>*</mirrorOf>
            <url>${env.INTERNAL_MAVEN_URL}</url>
          </mirror>
        </mirrors>
        <servers>
          <server>
            <id>internal</id>
            <username>${env.MIRROR_USER}</username>
            <password>${env.MIRROR_PASS}</password>
          </server>
        </servers>
      </settings>
      EOF

      # npm
      npm config set registry '${INTERNAL_NPM_URL}'

      # pip
      mkdir -p ~/.config
      cat > ~/.config/private-pypi.sh <<'EOF'
      export PIP_INDEX_URL="$INTERNAL_PYPI_URL"
      EOF

knowledge:
  - name: internal_python_packages
    contents: |
      With INTERNAL_PYPI_URL available, run:
        source ~/.config/private-pypi.sh && pip install -r requirements.txt

initialize:
  # 1. VPN-Client
  - name: Install VPN client
    run: |
      sudo DEBIAN_FRONTEND=noninteractive apt-get update -qq
      sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq openvpn

  # 2. DNS — interne Hostnamen auflösen
  - name: Configure DNS
    run: |
      sudo mkdir -p /etc/systemd/resolved.conf.d
      cat << 'DNS' | sudo tee /etc/systemd/resolved.conf.d/corp.conf > /dev/null
      [Resolve]
      DNS=10.0.0.53
      Domains=corp.internal
      DNS
      sudo systemctl restart systemd-resolved || true

  # 3. Zertifikate — internen CAs vertrauen
  - name: Install CA certificate
    run: |
      set -o pipefail
      printf '%s' "$CORP_ROOT_CA_B64" | base64 -d | openssl x509 -outform PEM \
        | sudo tee /usr/local/share/ca-certificates/corp-root-ca.crt > /dev/null
      sudo update-ca-certificates
      echo 'export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt' \
        | sudo tee /etc/profile.d/node-ca.sh > /dev/null

  # 4. Proxy — Datenverkehr über den Unternehmens-Proxy leiten
  - name: Configure proxy
    run: |
      cat << 'PROXY' | sudo tee /etc/profile.d/proxy.sh > /dev/null
      export http_proxy="$CORP_HTTP_PROXY"
      export https_proxy="$CORP_HTTPS_PROXY"
      export no_proxy="$CORP_NO_PROXY"
      export HTTP_PROXY="$CORP_HTTP_PROXY"
      export HTTPS_PROXY="$CORP_HTTPS_PROXY"
      export NO_PROXY="$CORP_NO_PROXY"
      PROXY
      source /etc/profile.d/proxy.sh

  # 5. Sprachlaufzeitumgebungen
  - name: Install language runtimes over VPN
    run: |
      (
        set -euo pipefail
        umask 077
        VPN_DIR=$(mktemp -d)
        cleanup() {
          if [ -f "$VPN_DIR/openvpn.pid" ]; then
            sudo kill "$(cat "$VPN_DIR/openvpn.pid")" || true
          fi
          sudo rm -rf "$VPN_DIR"
        }
        trap cleanup EXIT
        printf '%s' "$VPN_CONFIG_B64" | base64 -d > "$VPN_DIR/corp.conf"
        sudo openvpn --config "$VPN_DIR/corp.conf" \
          --writepid "$VPN_DIR/openvpn.pid" --daemon
        for i in $(seq 1 30); do
          if ip link show tun0 >/dev/null 2>&1; then break; fi
          sleep 1
        done
        ip link show tun0 >/dev/null
        source /etc/profile.d/proxy.sh
        sudo --preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY \
          apt-get update -qq
        sudo --preserve-env=http_proxy,https_proxy,no_proxy,HTTP_PROXY,HTTPS_PROXY,NO_PROXY \
          DEBIAN_FRONTEND=noninteractive apt-get install -y -qq openjdk-17-jdk-headless
        echo 'export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64' \
          | sudo tee /etc/profile.d/java.sh > /dev/null
        npm install -g pnpm
        curl -LsSf https://astral.sh/uv/install.sh | sh
      )

maintenance:
  - name: Configure Maven
    run: |
      mkdir -p ~/.m2
      cat > ~/.m2/settings.xml <<'EOF'
      <settings>
        <mirrors>
          <mirror>
            <id>corp</id>
            <mirrorOf>*</mirrorOf>
            <url>${env.MAVEN_REGISTRY_URL}</url>
          </mirror>
        </mirrors>
        <servers>
          <server>
            <id>corp</id>
            <username>${env.REGISTRY_USER}</username>
            <password>${env.REGISTRY_PASS}</password>
          </server>
        </servers>
      </settings>
      EOF

  - name: Configure npm
    run: |
      npm config set registry '${NPM_REGISTRY_URL}'
      NPM_HOST=$(echo "$NPM_REGISTRY_URL" | sed 's|https\?://||;s|/.*||')
      npm config set "//${NPM_HOST}/:_authToken" '${REGISTRY_TOKEN}'

  - name: Configure pip/uv
    run: |
      mkdir -p ~/.config
      cat > ~/.config/private-pypi.sh <<'EOF'
      export PIP_INDEX_URL="https://$REGISTRY_USER:$REGISTRY_PASS@${PYPI_REGISTRY_HOST}/simple"
      export UV_INDEX_URL="$PIP_INDEX_URL"
      EOF

knowledge:
  - name: internal_packages
    contents: |
      Use the temporary OpenVPN setup/cleanup block from the template library
      when an operation needs VPN access. Inside that block, with the registry
      and proxy secrets available, replace the sample curl command with:
        source /etc/profile.d/proxy.sh
        mvn dependency:resolve
        npm install
        source ~/.config/private-pypi.sh
        uv sync
      Percent-encode the pip URL credentials. Disconnect the VPN and remove its
      temporary files when the operation finishes.