fix: redact operational skill review sources

submitted-skills/Anonymous Operational Submission/skills/ndo-repro/SKILL.md

@@ -42,7 +42,7 @@ ndo-ship.sh build <service> [--ticket 231239] [--skip-tests] [--no-cache]
 - Java services: runs `mvn -B -DskipTests package` after the tests so `target/*.jar` exists for the `COPY`.
 - Builds `--platform linux/amd64`. **Never drop this** — the Mac is arm64, the nodes are amd64, and the mismatch only surfaces as a crashlooping pod after deploy.
 - Uses `Dockerfile_local` if present, else `Dockerfile`, and `--target release` when the dockerfile has stages. See `reference/dockerfile-local.md` before writing one.
-- Image ref: `artifactorycn.netcracker.com:17009/<artifactory-user>/<service>_unm_<ticket>:<utc-timestamp>`. Ticket is parsed from the git branch (`bugfix/UNM-231239` → `231239`). The timestamp tag matters: deployments run `imagePullPolicy: IfNotPresent`, so a reused tag silently keeps the old image.
+- Image ref: `[REDACTED REGISTRY]/<[REDACTED USER]>/<service>_unm_<ticket>:<utc-timestamp>`. Ticket is parsed from the git branch (`bugfix/UNM-231239` → `231239`). The timestamp tag matters: deployments run `imagePullPolicy: IfNotPresent`, so a reused tag silently keeps the old image.
 
 The ref is cached, so `push`/`deploy` need no `--tag`.
 

submitted-skills/Anonymous Operational Submission/skills/ndo-repro/envs.tsv

@@ -0,0 +1,3 @@
+# Published review fixture — original environment identities and endpoints removed.
+# alias	context	namespace	gateway
+sample/dev	[REDACTED CONTEXT]	[REDACTED NAMESPACE]	[REDACTED URL]

submitted-skills/Anonymous Operational Submission/skills/ndo-repro/lib/env.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Published review fixture — original environment discovery and endpoints removed.
+
+_ndo_die() { echo "$*" >&2; exit 2; }
+
+env_list() {
+  printf '%-16s %-34s %-14s %s\n' ALIAS CONTEXT NAMESPACE GATEWAY
+  printf '%-16s %-34s %-14s %s\n' sample/dev '[REDACTED CONTEXT]' '[REDACTED NAMESPACE]' '[REDACTED URL]'
+}
+
+env_resolve() {
+  _ndo_die "Environment resolution is disabled in this published, redacted review fixture."
+}
+
+env_discover() {
+  _ndo_die "Environment discovery is disabled in this published, redacted review fixture."
+}

submitted-skills/Anonymous Operational Submission/skills/ndo-repro/ndo-ship.sh

@@ -6,7 +6,7 @@ HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=lib/env.sh
 source "$HERE/lib/env.sh"
 
-REG="${NDO_REGISTRY:-artifactorycn.netcracker.com:17009}"
+REG="${NDO_REGISTRY:-[REDACTED REGISTRY]}"
 ART_USER="${NDO_ARTIFACTORY_USER:-$USER}"
 PLATFORM="${NDO_PLATFORM:-linux/amd64}"
 PROJECTS="${NDO_PROJECTS:-$HOME/projects}"
@@ -48,7 +48,7 @@ Options:
       --timeout D     rollout wait (default 10m)
   -y, --yes           confirm a cluster-mutating command (deploy/ship/rollback/pullsecret)
 
-Image ref: $REG/<artifactory-user>/<service>_unm_<ticket>:<tag>
+Image ref: $REG/<[REDACTED USER]>/<service>_unm_<ticket>:<tag>
 Env overrides: NDO_REGISTRY NDO_ARTIFACTORY_USER NDO_PLATFORM NDO_PROJECTS NDO_ENV
 USAGE
 }

submitted-skills/Anonymous Operational Submission/skills/ndo-repro/reference/bom-Dockerfile_local.example

@@ -3,7 +3,7 @@
 # and the shared_resources COPY (CI-injected, absent locally).
 # Copy to ~/projects/business-operation-manager/Dockerfile_local to use.
 
-FROM artifactorycn.netcracker.com:17014/product/go-builder:1.26.4 AS base
+FROM [REDACTED REGISTRY]/product/go-builder:1.26.4 AS base
 
 ENV APP_ROOT=/tmp/project
 COPY . ${APP_ROOT}
@@ -15,7 +15,7 @@ RUN chmod -R u+x ${APP_ROOT}/scripts && \
 FROM base AS build
 RUN cd ${APP_ROOT} && ${APP_ROOT}/application_build.sh
 
-FROM artifactorycn.netcracker.com:17152/netcracker/qubership-core-base:2.3.7 AS release
+FROM [REDACTED REGISTRY]/netcracker/qubership-core-base:2.3.7 AS release
 
 COPY --chown=10001:10001 --from=build /tmp/project/scripts/* /bin/
 COPY --chown=10001:10001 --from=build /tmp/project/business-operation-manager /bin/app

submitted-skills/Anonymous Operational Submission/skills/ndo-repro/reference/dockerfile-local.md

@@ -0,0 +1,9 @@
+# Local Dockerfile note — redacted review fixture
+
+The original operational reference included internal source locations, registries,
+and environment details. Those details have been removed from the published review.
+
+For a local Dockerfile guide, keep the general rule: use a project-owned local
+override only when the ordinary Dockerfile requires CI-only inputs. Keep runtime
+stages, explicit architecture handling, and the application artifact; never copy
+credentials, internal endpoints, or personal registry paths into the override.

submitted-skills/Pedro Aranha/skills/ndo-repro/envs.tsv

@@ -1,15 +0,0 @@
-oss-01/dev-1	pedro.aranha-saas-rnd-oss-01	dev-1-oss	https://public-gateway-dev-1-oss.saas-rnd-oss-01.managed.netcracker.cloud
-oss-01/dev-2	pedro.aranha-saas-rnd-oss-01	dev-2-oss	https://public-gateway-dev-2-oss.saas-rnd-oss-01.managed.netcracker.cloud
-oss-01/dev-3	pedro.aranha-saas-rnd-oss-01	dev-3-oss	https://public-gateway-dev-3-oss.saas-rnd-oss-01.managed.netcracker.cloud
-oss-01/dev-4	pedro.aranha-saas-rnd-oss-01	dev-4-oss	https://public-gateway-dev-4-oss.saas-rnd-oss-01.managed.netcracker.cloud
-oss-02/dev-0	pedro.aranha-saas-rnd-oss-02	dev-0-oss	https://public-gateway-dev-0-oss.saas-rnd-oss-02.managed.netcracker.cloud
-oss-02/dev-2	pedro.aranha-saas-rnd-oss-02	dev-2-oss	https://public-gateway-dev-2-oss.saas-rnd-oss-02.managed.netcracker.cloud
-oss-02/dev-3	pedro.aranha-saas-rnd-oss-02	dev-3-oss	https://public-gateway-dev-3-oss.saas-rnd-oss-02.managed.netcracker.cloud
-oss-02/dev-4	pedro.aranha-saas-rnd-oss-02	dev-4-oss	https://public-gateway-dev-4-oss.saas-rnd-oss-02.managed.netcracker.cloud
-oss-03/dev-0	pedro.aranha-saas-rnd-oss-03	dev-0-oss	https://public-gateway-dev-0-oss.saas-rnd-oss-03.managed.netcracker.cloud
-oss-03/dev-1	pedro.aranha-saas-rnd-oss-03	dev-1-oss	https://public-gateway-dev-1-oss.saas-rnd-oss-03.managed.netcracker.cloud
-oss-03/dev-2	pedro.aranha-saas-rnd-oss-03	dev-2-oss	https://public-gateway-dev-2-oss.saas-rnd-oss-03.managed.netcracker.cloud
-oss-03/dev-3	pedro.aranha-saas-rnd-oss-03	dev-3-oss	https://public-gateway-dev-3-oss.saas-rnd-oss-03.managed.netcracker.cloud
-shared-244	ndo-shared-244	ndo	https://public-gateway-ndo.ndo-shared-244.managed.netcracker.cloud
-shared-244/ndo-at	ndo-shared-244	ndo-at	https://public-gateway-ndo-at.ndo-shared-244.managed.netcracker.cloud
-shared-244/ndo-dev	ndo-shared-244	ndo-dev	https://public-gateway-ndo-dev.ndo-shared-244.managed.netcracker.cloud

submitted-skills/Pedro Aranha/skills/ndo-repro/lib/env.sh

@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-# Shared env resolution for the ndo-repro skill. Source this; do not execute.
-# Exports NDO_CTX (kube context), NDO_NS (namespace), NDO_GW (gateway base URL).
-
-NDO_CACHE="${NDO_CACHE:-$HOME/.cache/ndo-repro}"
-NDO_ENV_FILE="${NDO_ENV_FILE:-$NDO_CACHE/envs.tsv}"
-NDO_ENV_SEED="${NDO_ENV_SEED:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/envs.tsv}"
-NDO_MARKER="${NDO_MARKER:-consolidated-inventory-manager-v1}"
-NDO_NS_RE="${NDO_NS_RE:-^(ndo|ndo-dev|ndo-at|dev-[0-9]+-oss)$}"
-
-_ndo_die() { echo "$*" >&2; exit 2; }
-
-env_file() {
-  [ -s "$NDO_ENV_FILE" ] && { echo "$NDO_ENV_FILE"; return; }
-  mkdir -p "$NDO_CACHE"
-  [ -s "$NDO_ENV_SEED" ] && cp "$NDO_ENV_SEED" "$NDO_ENV_FILE"
-  echo "$NDO_ENV_FILE"
-}
-
-env_list() {
-  printf '%-16s %-34s %-14s %s\n' ALIAS CONTEXT NAMESPACE GATEWAY
-  awk -F'\t' '!/^#/ && NF>=4 {printf "%-16s %-34s %-14s %s\n",$1,$2,$3,$4}' "$(env_file)"
-}
-
-# env_resolve <alias>  -> sets NDO_CTX / NDO_NS / NDO_GW
-env_resolve() {
-  local want="${1:-}" f hits n
-  [ -n "$want" ] || _ndo_die "no env given. Use -e <alias> or NDO_ENV=<alias>. Known:
-$(env_list)"
-  f="$(env_file)"
-  hits=$(awk -F'\t' -v w="$want" '!/^#/ && NF>=4 && ($1==w || $1 ~ "/" w "$")' "$f")
-  n=$(printf '%s' "$hits" | grep -c . || true)
-  [ "$n" -eq 0 ] && _ndo_die "unknown env '$want'. Known:
-$(env_list)
-Run: ndo-api.sh env discover"
-  [ "$n" -gt 1 ] && _ndo_die "ambiguous env '$want' — matches:
-$(printf '%s\n' "$hits" | cut -f1)
-Use the full alias (e.g. oss-01/$want)."
-  NDO_CTX=$(printf '%s' "$hits" | cut -f2)
-  NDO_NS=$(printf '%s' "$hits" | cut -f3)
-  NDO_GW=$(printf '%s' "$hits" | cut -f4)
-  export NDO_CTX NDO_NS NDO_GW
-}
-
-# Short cluster alias: pedro.aranha-saas-rnd-oss-01 -> oss-01 ; ndo-shared-244 -> shared-244
-_cluster_alias() { sed -E 's/^.*saas-rnd-//; s/^ndo-//' <<<"$1"; }
-# Short env alias: dev-1-oss -> dev-1 ; ndo -> (cluster alias only)
-_ns_alias() { sed -E 's/-oss$//' <<<"$1"; }
-
-env_discover() {
-  local out ctx nss ns host alias calias nalias
-  mkdir -p "$NDO_CACHE"
-  out="$NDO_CACHE/envs.tsv.new"
-  : > "$out"
-  for ctx in $(kubectl config get-contexts -o name 2>/dev/null); do
-    case "$ctx" in orbstack|docker-desktop|minikube|kind-*) continue ;; esac
-    nss=$(timeout 25 kubectl --context="$ctx" get ns -o name 2>/dev/null | sed 's|namespace/||' | grep -E "$NDO_NS_RE") || continue
-    calias=$(_cluster_alias "$ctx")
-    for ns in $nss; do
-      timeout 20 kubectl --context="$ctx" -n "$ns" get deploy "$NDO_MARKER" -o name >/dev/null 2>&1 || continue
-      host=$(timeout 20 kubectl --context="$ctx" -n "$ns" get ingress public-gateway \
-               -o jsonpath='{.spec.rules[0].host}' 2>/dev/null)
-      [ -n "$host" ] || host="public-gateway-${ns}.$(sed -E 's/^.*(saas-rnd-[a-z0-9-]+|ndo-[a-z0-9-]+)$/\1/' <<<"$ctx").managed.netcracker.cloud"
-      nalias=$(_ns_alias "$ns")
-      if [ "$nalias" = "ndo" ]; then alias="$calias"; else alias="$calias/$nalias"; fi
-      printf '%s\t%s\t%s\thttps://%s\n' "$alias" "$ctx" "$ns" "$host" >> "$out"
-      echo "found $alias -> $ctx/$ns" >&2
-    done
-  done
-  [ -s "$out" ] || _ndo_die "discovery found no envs (VPN down? kube creds expired?) — kept $NDO_ENV_FILE"
-  sort -o "$out" "$out"
-  mv "$out" "$NDO_ENV_FILE"
-  env_list
-}

submitted-skills/Pedro Aranha/skills/ndo-repro/reference/dockerfile-local.md

@@ -1,50 +0,0 @@
-# Dockerfile_local
-
-`Dockerfile_local` is the CI `Dockerfile` with the parts that only work on a Jenkins agent removed, so it builds on a laptop. Upstream example (Go service):
-<https://git.netcracker.com/PROD.INMRND.UNM/object-group-manager/-/blob/master/Dockerfile_local>
-
-Create one only when the plain `Dockerfile` fails locally. `ndo-ship.sh` picks `Dockerfile_local` automatically when present, otherwise falls back to `Dockerfile`.
-
-## What to strip from the CI Dockerfile
-- `COPY`/`ADD` of shared resources, config bundles, or licence files injected by the pipeline.
-- `ARG`s the pipeline fills (DB hosts, wiremock hosts, credentials) — hardcode a dev value or drop the stage.
-- Integration/`test` stages that need Mongo/Postgres/Arango/Kafka. Keep pure unit tests only, or run tests outside Docker.
-- `test-report` / coverage export stages — dead weight for a repro image.
-
-## What must stay
-- A stage named `release` — `ndo-ship.sh` builds `--target release` when the dockerfile has stages.
-- The runtime base image and every `COPY` that puts the binary/jar plus its runtime resources in place.
-
-## Java / Maven services (CIM, device-library, …)
-Their `Dockerfile` is single-stage and copies a prebuilt jar:
-
-```dockerfile
-COPY --chown=10001:10001 target/consolidated-inventory-manager*.jar /app/app.jar
-```
-
-`ndo-ship.sh` detects `pom.xml` + a `COPY … target/` line and runs `mvn -B -DskipTests package` before `docker build`, so the jar exists. No `Dockerfile_local` is needed unless the base image or an `apk` mirror is unreachable from the laptop.
-
-If the `apk add` step fails (internal `yumsrv03cn` mirror unreachable off-VPN), that layer only installs fonts — a `Dockerfile_local` that drops it is fine for a repro image:
-
-```dockerfile
-FROM artifactorycn.netcracker.com:17003/alpine/openjdk17:17.0.18.8.03 AS release
-USER root
-COPY --chown=10001:10001 target/consolidated-inventory-manager*.jar /app/app.jar
-USER 10001:10001
-CMD ["java", "-jar", "/app/app.jar"]
-```
-
-A working example that built and deployed cleanly is kept alongside this file: `bom-Dockerfile_local.example` (business-operation-manager, verified 2026-08-12).
-
-## Go services (BOM, monitoring-*, …)
-Already multi-stage with `base` / `test` / `build` / `release`. The usual local-only edits: drop the `test` stage's external `ARG` hosts, and drop `COPY … /shared_resources` if the pipeline generates it.
-
-The Go build stages already pin `GOARCH=amd64`, so they cross-compile fine, but the **runtime** stage still needs `--platform linux/amd64` (see below).
-
-## Architecture — the trap
-The Mac is arm64; the clusters are amd64. Without `--platform linux/amd64` the image builds and pushes fine, then the pod dies with `exec format error` or `no match for platform in manifest`. `ndo-ship.sh` passes `--platform linux/amd64` by default; do not remove it.
-
-An amd64 build on an arm64 host runs under emulation, so the maven/go steps inside Docker are slow. That is why `ndo-ship.sh` runs Maven natively on the host and only the image assembly under Docker.
-
-## Registry
-`artifactorycn.netcracker.com:17009` is the personal/dev repo — images land under `<artifactory-user>/…`. Product images live in `:17099` and `:17003`; never push there.