Go (slog, health handlers): skills/project-templates/go.md
.NET (Serilog, health endpoint): skills/project-templates/dotnet.md
DevOps Templates
GitHub Actions CI Workflow
Runtime-specific CI workflows are in the runtime sub-files (nodejs.md, python.md, go.md, dotnet.md).
docker-compose.yml — MANDATORY for all backend services
Every backend service MUST include a docker-compose.yml for local development. Web frontends SHOULD also include one if they have backend dependencies.
IMPORTANT — Port collision prevention: Each service in the architecture MUST use a unique host port. Assign ports sequentially starting from the manifest's dev_port for each component. Never use the same host port for two different services. Use the ${PORT:-{{dev-port}}} pattern so ports can be overridden via .env.
services:
{{component-name}}:build:.ports:-"${PORT:-{{dev-port}}}:{{dev-port}}"env_file:.envdepends_on:-db-redis# Add/remove services based on manifest databases.# Use unique host ports per component to avoid collisions across services.db:image:postgres:16-alpineenvironment:POSTGRES_DB: {{component-name}}
POSTGRES_USER:postgresPOSTGRES_PASSWORD:postgresports:-"{{db-host-port}}:5432"volumes:-pgdata:/var/lib/postgresql/dataredis:image:redis:7-alpineports:-"{{redis-host-port}}:6379"volumes:pgdata:
Port assignment strategy for multi-service architectures:
When scaffolding multiple services, assign non-overlapping host ports for infrastructure containers:
Service 1 DB: 5432, Redis: 6379
Service 2 DB: 5433, Redis: 6380
Service 3 DB: 5434, Redis: 6381
And so on...
This prevents port collisions when running multiple services locally at the same time.
Shared Package Templates
Shared Types Package
Runtime-specific shared types packages are in the runtime sub-files:
Generate one block per package ecosystem present in the project. Always include the github-actions block.
Security Scanning Workflow
Add .github/workflows/security.yml — language-agnostic, works for all runtimes:
name:Securityon:push:branches: [main]
pull_request:branches: [main]
schedule:-cron:"0 6 * * 1"# weekly Monday 06:00 UTCpermissions:contents:readsecurity-events:write# required for CodeQL to upload SARIF resultsjobs:secret-scan:name:Secretscanning(Gitleaks)runs-on:ubuntu-lateststeps:-uses:actions/checkout@v4with:fetch-depth:0# full history so Gitleaks can scan all commits-uses:gitleaks/gitleaks-action@v2env:GITHUB_TOKEN:${{secrets.GITHUB_TOKEN}}codeql:name:SAST(CodeQL)runs-on:ubuntu-lateststrategy:matrix:# Add only the languages present in this repolanguage: [javascript-typescript]
# Other supported values: python, go, csharp, java, ruby, swiftsteps:-uses:actions/checkout@v4-uses:github/codeql-action/init@v3with:languages:${{matrix.language}}queries:security-and-quality-uses:github/codeql-action/autobuild@v3-uses:github/codeql-action/analyze@v3with:category:"/language:${{ matrix.language }}"
Language matrix values by runtime:
Runtime
language value
Node.js / TypeScript
javascript-typescript
Python
python
Go
go
.NET / C#
csharp
Multiple runtimes in monorepo
list all: [javascript-typescript, python]
CodeQL results appear in the GitHub Security tab → Code scanning alerts. No external accounts needed — it's built into GitHub.
.gitleaks.toml (optional — add to repo root to suppress false positives):
[allowlist]description = "Global allowlist"paths = [
".env.example", # example files intentionally contain placeholder keys
]
regexes = [
"EXAMPLE_", # suppress vars named *_EXAMPLE_*"your-.*-here", # suppress placeholder strings
]
.gitignore
Runtime-specific .gitignore files are in the runtime sub-files (nodejs.md, python.md, go.md, dotnet.md). Always add one per component.
.env.example
Generate from the manifest's integrations and environments. Format:
Backend service:
# Server
PORT={{dev-port}}
NODE_ENV=development
# {{service-name}} — {{category}}# Get credentials at: {{signup-url}}
{{ENV_VAR_NAME}}=
Web frontend (Vite):
# API URLs — update per environment# DEV: http://localhost:{{backend-dev-port}}# STAGING: {{staging-url}}# PROD: {{prod-url}}
VITE_API_URL=http://localhost:{{backend-dev-port}}
# WebSocket URL (if realtime is configured)# VITE_WS_URL=ws://localhost:{{backend-dev-port}}# Monitoring# VITE_SENTRY_DSN=# VITE_APP_INSIGHTS_KEY=
Mobile app (Expo):
# API URLs — update per environment# DEV: http://localhost:{{backend-dev-port}}# STAGING: {{staging-url}}# PROD: {{prod-url}}
EXPO_PUBLIC_API_URL=http://localhost:{{backend-dev-port}}
# Push Notifications# EXPO_PUBLIC_PUSH_PROJECT_ID=# Monitoring# EXPO_PUBLIC_SENTRY_DSN=# OTA Updates# EXPO_PUBLIC_UPDATE_URL=
Include a comment with the signup URL for each integration service so the user knows where to get credentials. Use environment URLs from the manifest's environments section.
README.md
Auto-generate for each component:
# {{component-name}}
{{component-description}}
## Tech Stack-**Framework:** {{framework}}
-**Language:** {{language}}
## Setup1. Clone the repository
2. Copy environment variables: `cp .env.example .env`3. Fill in your credentials in `.env`4. Install dependencies: `{{install-command}}`5. Start development server: `{{dev-command}}`## Scripts
| Command | Description |
|---------|-------------|
| `{{dev-command}}` | Start development server |
| `{{build-command}}` | Build for production |
| `{{start-command}}` | Start production server |
## Architecture
This component is part of the **{{project-name}}** architecture.
Other components:
{{#each other-components}}
-**{{name}}** — {{description}}
{{/each}}
---
*Scaffolded by [Architect AI](https://github.com/navraj007in/architecture-cowork-plugin)*
Dockerfile — MANDATORY for all backends and agents
Every backend service, worker, and agent MUST include a Dockerfile. This is not optional.
Runtime-specific Dockerfiles are in the runtime sub-files:
