entur-project-bootstrap

name

entur-project-bootstrap

description

Bootstrap a new Entur application from scratch. Generates self-service manifests, Helm chart, Terraform scaffolding, Dockerfile, and CI/CD workflows -- all with correct cross-file coordination (metadata.id = Helm shortname = Terraform app_id). Use this skill when the user says "new project", "bootstrap", "scaffold", "create a new app", "set up a new service", or needs to generate the full infrastructure setup for a new application at Entur.

Entur Project Bootstrap

Generate the complete infrastructure scaffolding for a new Entur application. This skill coordinates across self-service, Helm, Terraform, Docker, and CI/CD to ensure all identifiers are consistent.

Step 1: Gather Inputs

Ask the user for the following. If not provided, suggest sensible defaults:

Input	Required	Constraints	Default
Repository name	yes	lowercase kebab-case, max 63 chars, [a-z0-9-]	--
App ID (metadata.id)	yes	3-10 lowercase alphanumeric ^[a-z0-9]+$, no ent- prefix, no env suffixes	--
Team	yes	must start with team-	--
Language	yes	kotlin, java, go, python	kotlin
Environments	no	subset of dev, tst, prd	[dev, tst, prd]
Needs database	no	boolean	false
Needs Redis	no	boolean	false
Needs Kafka	no	boolean	false
Needs Auth0 M2M	no	boolean	false
Display name	no	human-readable name	derived from repo name

Validation Rules

Before proceeding, validate:

• metadata.id is 3-10 chars, ^[a-z0-9]+$
• metadata.id ALWAYS uses bare identifiers (the platform adds the ent- prefix)
• metadata.id ALWAYS uses base identifiers (the platform adds environment suffixes)
• Repository name is valid kebab-case
• Team starts with team-

Step 2: Print the Identity Chain

Before generating files, print the identity chain for the user to confirm:

Identity Chain:
  metadata.id:        {appId}
  metadata.name:      {repoName}       (K8s namespace)
  GCP projects:       ent-{appId}-dev, ent-{appId}-tst, ent-{appId}-prd
  Helm app:           {repoName}
  Helm shortname:     {appId}
  Terraform app_id:   {appId}
  TF state bucket:    ent-gcs-tfa-{appId}
  Docker image:       {repoName}
  Secret Manager:     ent-{appId}-{env}

Ask the user to confirm before generating files.

Step 3: Generate Self-Service Manifests

.entur/cicd.yml

apiVersion: orchestrator.entur.io/github/v1
kind: GitHubActions
metadata:
  id: {repoName}
spec:
  environments: [{environments}]

.entur/{appId}.yaml

apiVersion: orchestrator.entur.io/apps/v1
kind: GoogleCloudApplication
metadata:
  id: {appId}
  displayName: "{displayName}"
  name: {repoName}
  owner: {team}
  trigger: {currentUnixTimestamp}
spec:
  environments: [{environments}]
  repositories: [{repoName}]
  terraform:
    createBackend: true
  secretManager:
    enabled: true
    serviceAccount: application

If auth0 M2M is needed, add under spec:

  auth0:
    internal:
      enabled: true
      type: m2m

Step 4: Generate Helm Chart

Read guides/platform/common-helm.md in the entur/ai repository for the full common chart reference.

helm/{repoName}/Chart.yaml

apiVersion: v2
name: {repoName}
version: 0.1.0
dependencies:
  - name: common
    version: "1.21.1"
    repository: "https://entur.github.io/helm-charts"
    alias: common

helm/{repoName}/values.yaml

common:
  app: {repoName}
  shortname: {appId}
  team: {teamWithoutPrefix}
  container:
    image: {repoName}
    cpu: {cpuByLanguage}
    memory: {memoryByLanguage}
    memoryLimit: {memoryByLanguage}
    probes:
      liveness:
        path: {livenessByLanguage}
      readiness:
        path: {readinessByLanguage}
    prometheus:
      enabled: true
      path: {metricsByLanguage}
  service:
    internalPort: 8080
  ingress:
    enabled: true
    trafficType: api
  configmap:
    enabled: true

Language defaults:

Setting	Kotlin/Java	Go	Python
cpu	0.5	0.1	0.2
memory	512	64	128
liveness path	/actuator/health/liveness	/health/liveness	/health/liveness
readiness path	/actuator/health/readiness	/health/readiness	/health/readiness
metrics path	/actuator/prometheus	/metrics	/metrics

If database is needed, add:

  postgres:
    enabled: true
    connectionConfig: {repoName}

If secrets are needed (do NOT add PGUSER/PGPASSWORD here — those are already provided by postgres.enabled), add:

  secrets:
    my-app-secrets: [MY_APP_API_KEY, EXTERNAL_SERVICE_KEY]

helm/{repoName}/env/dev.yaml

common:
  env: dev
  configmap:
    data:
      SPRING_PROFILES_ACTIVE: "dev"
      SPRING_CLOUD_GCP_SECRETMANAGER_PROJECTID: "ent-{appId}-dev"

Generate tst.yaml and prd.yaml with the same pattern, adjusting the environment and project ID.

For prd, also set:

  hpa:
    spec:
      maxReplicas: 5
  pdb:
    minAvailable: 50%

Step 5: Generate Terraform Scaffolding

Read guides/platform/terraform-modules.md in the entur/ai repository for the full module reference.

terraform/main.tf

module "init" {
  source      = "github.com/entur/terraform-google-init//modules/init?ref=v1"
  app_id      = var.app_id
  environment = var.environment
}

If database is needed, add:

module "postgresql" {
  source    = "github.com/entur/terraform-google-sql-db//modules/postgresql?ref=v1"
  init      = module.init
  databases = ["{repoName}"]
}

If Redis is needed, add:

module "redis" {
  source = "github.com/entur/terraform-google-memorystore//modules/redis?ref=v2"
  init   = module.init
}

terraform/variables.tf

variable "app_id" {
  description = "Application ID (must match self-service metadata.id)"
  type        = string
}

variable "environment" {
  description = "Environment: dev, tst, or prd"
  type        = string
}

terraform/providers.tf

terraform {
  backend "gcs" {
    bucket = "ent-gcs-tfa-{appId}"
  }

  required_providers {
    google = {
      source = "hashicorp/google"
    }
  }
}

terraform/env/dev.tfvars, tst.tfvars, prd.tfvars

app_id      = "{appId}"
environment = "{env}"

Step 6: Generate Dockerfile

Read guides/reference/docker.md in the entur/ai repository for the full Docker reference.

Select the Dockerfile template based on language:

Kotlin/Java

Use multi-stage with a layered JAR and distroless runtime:

• Build stage: gradle:9.3.1-jdk25-alpine
• Layers stage: eclipse-temurin:25-jre-alpine
• Runtime stage: gcr.io/distroless/java25-debian13:nonroot
• Non-root runtime, port 8080, -XX:MaxRAMPercentage=75.0

Go

• Build stage: golang:1.25-alpine with CGO_ENABLED=0
• Runtime stage: gcr.io/distroless/static-debian12:nonroot
• Port 8080

Python

• Build stage: python:3.12-slim with pip install
• Runtime stage: python:3.12-slim
• Non-root user, port 8080

Step 7: Generate CI/CD Workflows

Delegate to the setup-cicd-workflows skill (skills/setup-cicd-workflows/SKILL.md in the entur/ai repository) -- it is the canonical source for workflow file names, structure, and reusable-workflow @vN pins. Do not generate these files from this skill: keeping two sources of truth has already caused drift.

Do not restate the workflow file list in this skill. Workflow files use .yml; the setup-cicd skill owns the exact set.

For background on each workflow's role, read guides/platform/gha-workflows.md in the entur/ai repository.

Step 8: Generate Supporting Files

.mise.toml

[tools]
java        = 'temurin-25'            # Kotlin/Java
# go        = '1.25'                   # Go
terraform   = '1.15.6'

[settings]
experimental = true

[hooks]
enter = 'mise install'

AGENTS.md

# {displayName}

{language} application that {brief description}.

## Entur Standards

Read and follow the Entur platform standards at:
https://github.com/entur/ai/blob/main/AGENTS.md

## Project-Specific

- App ID: {appId}
- GCP Projects: ent-{appId}-dev, ent-{appId}-tst, ent-{appId}-prd

Step 9: Print Summary

After generating all files, print:

1. Files created (list with paths)
2. The identity chain (repeated for reference)
3. Next steps:
   • Run helm dependency update helm/{repoName}/
   • Commit self-service manifests, open PR, comment entur apply
   • After GCP projects are created: set up Terraform workspaces and apply
   • Configure Helm deploy via CI/CD

Critical Rules

• Never create GCP projects via Terraform or gcloud -- only via self-service manifests
• Always use Entur Terraform modules, not raw google_* resources
• Always use the Entur common Helm chart
• Always use Entur reusable GitHub Actions workflows
• Pin all dependencies -- Terraform ?ref=TAG, Actions @vN, Docker image tags
• metadata.id is immutable -- changing it deletes and recreates GCP projects