sdlc-plugins

A Claude Code plugin marketplace for AI-assisted SDLC workflow skills.

This repository hosts reusable skills that help engineers set up projects, plan features, implement tasks, and verify pull requests with full Jira traceability. Any project can install these skills via Claude Code's plugin system.

Available Plugins

sdlc-workflow

AI-assisted SDLC workflow skills for setting up projects, planning features, implementing tasks, and verifying pull requests:

• setup — Set up or update the Project Configuration in your CLAUDE.md for use with sdlc-workflow skills.

• define-feature — Interactively define a Jira Feature by walking through all description template sections and creating the issue.

• plan-feature — Convert a Jira feature into an implementation plan with structured Jira tasks. Analyzes repositories using Serena LSP, builds an impact map, and creates linked Jira tasks.

• implement-task — Implement a Jira task by reading its structured description, modifying code, running tests, committing, opening a PR, and updating Jira.

• verify-pr — Verify a PR against its Jira task's acceptance criteria and deterministic guardrails.

• report-bug — Interactively define a Jira Bug by walking through project-configured template sections, or accept structured input programmatically from other skills.

• triage-bug — Triage a Jira Bug issue by investigating root cause through codebase analysis, posting a root cause comment, and producing a linked fix Task with a reproducer test front-loaded for /implement-task consumption.

• triage-security — Triage PSIRT-created Vulnerability issues (CVEs) with version-aware impact analysis across supported product versions. Includes a discovery mode for listing untriaged vulnerabilities.

• run-evals — Run structured eval suites against skills to measure output quality and catch regressions.

Installation

1. Add the marketplace

/plugin marketplace add RHEcosystemAppEng/sdlc-plugins

2. Install the plugin

/plugin install sdlc-workflow

This copies the plugin's skills into your project, making them available as slash commands.

3. Configure your project

/sdlc-workflow:setup

This interactively populates the required Project Configuration in your project's CLAUDE.md (repository registry, Jira settings, and code intelligence).

Sandbox Credential Isolation

This repository includes a .claude/settings.json file that configures sandbox.credentials.envVars deny entries for 16 credential environment variables across four categories: GCP (9), Anthropic/Vertex AI (3), GitHub (2), and AWS (2). When the sandbox is enabled, these variables are stripped from Bash subprocesses while Claude Code's own runtime retains access for API authentication.

The sandbox is opt-in — it is not enabled automatically. Run /sandbox at the start of each session to activate it.

Verifying the deny entries

After enabling the sandbox, confirm that denied variables are stripped:

/sandbox

Then in a Bash command, check that a denied variable is empty:

echo "GITHUB_TOKEN=$GITHUB_TOKEN"

The output should show an empty value. If Claude Code can still call APIs (Jira, GitHub), the runtime retained its own access while the sandbox stripped the variable from the Bash subprocess.

JIRA_API_TOKEN

JIRA_API_TOKEN is intentionally not included in the project-level deny entries. It requires mask mode (which redacts the value rather than removing it entirely), and mask can only be set from user-level settings, managed settings, or the --settings CLI flag — not from project-level .claude/settings.json. To mask it locally, add the following to your .claude/settings.local.json:

{
  "sandbox": {
    "credentials": {
      "envVars": [
        { "name": "JIRA_API_TOKEN", "mode": "mask" }
      ]
    }
  }
}

Project Configuration

For the skills to work with your project, your project's CLAUDE.md must implement the Project Configuration Contract.

The contract requires three sections in your CLAUDE.md:

1. Repository Registry — maps repos to Serena instances and local paths
2. Jira Configuration — project key, cloud ID, issue type IDs
3. Code Intelligence — Serena tool naming and per-instance limitations

See docs/project-config-contract.md for the full specification and a complete example.

Evaluations

Several skills have structured eval suites for measuring output quality and catching regressions. See the eval directories for each skill:

• evals/plan-feature/ — Plan-feature eval cases
• evals/define-feature/ — Define-feature eval cases
• evals/implement-task/ — Implement-task eval cases
• evals/verify-pr/ — Verify-pr eval cases
• evals/report-bug/ — Report-bug eval cases
• evals/triage-bug/ — Triage-bug eval cases
• evals/triage-security/ — Triage-security eval cases
• evals/setup/ — Setup eval cases

See evals/README.md for usage instructions and the iteration workflow.

Documentation

• Methodology — Core principles and SDLC phases
• Workflow — Execution workflow (plan, implement, verify) and skill invocation
• Tools — MCP server catalog (Jira, Figma, Serena)
• Conventions Spec — Cross-repo workflow conventions and per-repo template reference
• Constraints — Deterministic rules for agent behavior
• Project Configuration Contract — Project Configuration contract for CLAUDE.md
• Metrics — Workflow metrics and measurement
• Releasing — Release process and changelog
• Architecture Template — Template for documenting your project's architecture
• Conventions Template — Template for documenting your project's coding conventions

Contributing

We welcome contributions! See CONTRIBUTING.md for the contributors ladder, promotion criteria, and workflows for issues and pull requests.

License

Apache-2.0. See LICENSE.