From Vibe Coding to Spec-Driven Development: Part 4 - Team collaboration and advanced patterns

# .github/workflows/spec-driven-ci.yml
name: Spec-Driven CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  DOTNET_VERSION: '9.0.x'

jobs:
  validate-specs:
    name: Validate Specifications
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Check spec completeness
        run: |
          # Verify required sections exist
          for section in "User Stories" "Acceptance Criteria" "Edge Cases"; do
            if ! grep -q "## $section" .speckit/spec.md; then
              echo "::error::Missing required section: $section"
              exit 1
            fi
          done
          
      - name: Check for TODO markers
        run: |
          if grep -r "TODO\|FIXME\|XXX" .speckit/*.md; then
            echo "::error::Unresolved TODO markers in specifications"
            exit 1
          fi
          
      - name: Validate constitution compliance
        run: |
          # Check nullable reference types (from constitution)
          if ! grep -q "<Nullable>enable</Nullable>" src/*.csproj; then
            echo "::error::Nullable reference types not enabled"
            exit 1
          fi

  build-and-test:
    name: Build and Test
    runs-on: ubuntu-latest
    needs: validate-specs
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: $
          
      - name: Restore dependencies
        run: dotnet restore
        
      - name: Build
        run: dotnet build --no-restore --configuration Release
        
      - name: Run tests
        run: dotnet test --no-build --configuration Release --collect:"XPlat Code Coverage"
        
      - name: Check coverage threshold
        run: |
          # Constitution requires 80% coverage
          coverage=$(cat TestResults/*/coverage.cobertura.xml | grep -oP 'line-rate="\K[^"]+')
          if (( $(echo "$coverage < 0.80" | bc -l) )); then
            echo "::error::Coverage ${coverage} below 80% threshold"
            exit 1
          fi

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: build-and-test
    steps:
      - uses: actions/checkout@v4
      
      - name: Run dependency audit
        run: dotnet list package --vulnerable --include-transitive
        
      - name: OWASP dependency check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: 'TeamTaskManager'
          path: '.'
          format: 'HTML'

  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    needs: [build-and-test, security-scan]
    if: github.ref == 'refs/heads/main'
    environment: staging
    steps:
      - uses: actions/checkout@v4
      
      - name: Deploy to staging
        run: |
          # Your deployment script here
          echo "Deploying to staging..."

# azure-pipelines.yml
trigger:
  branches:
    include:
      - main
  paths:
    exclude:
      - README.md
      - docs/*

pr:
  branches:
    include:
      - main

pool:
  vmImage: 'ubuntu-latest'

variables:
  dotnetVersion: '9.0.x'
  buildConfiguration: 'Release'

stages:
  - stage: Validate
    displayName: 'Validate Specifications'
    jobs:
      - job: ValidateSpecs
        displayName: 'Spec Validation'
        steps:
          - checkout: self
          
          - task: Bash@3
            displayName: 'Check spec completeness'
            inputs:
              targetType: 'inline'
              script: |
                echo "Checking specification completeness..."
                
                required_sections=("User Stories" "Acceptance Criteria" "Edge Cases")
                for section in "${required_sections[@]}"; do
                  if ! grep -q "## $section" .speckit/spec.md; then
                    echo "##vso[task.logissue type=error]Missing required section: $section"
                    exit 1
                  fi
                done
                
                echo "All required sections present"
                
          - task: Bash@3
            displayName: 'Check for unresolved TODOs'
            inputs:
              targetType: 'inline'
              script: |
                if grep -r "TODO\|FIXME" .speckit/*.md; then
                  echo "##vso[task.logissue type=error]Unresolved TODO markers found"
                  exit 1
                fi
                
          - task: Bash@3
            displayName: 'Validate constitution compliance'
            inputs:
              targetType: 'inline'
              script: |
                # Check nullable reference types enabled
                if ! grep -q "<Nullable>enable</Nullable>" src/*.csproj; then
                  echo "##vso[task.logissue type=error]Nullable reference types not enabled (constitution violation)"
                  exit 1
                fi
                
                # Check for raw SQL (prohibited by constitution)
                if grep -r "ExecuteSqlRaw\|FromSqlRaw" src/; then
                  echo "##vso[task.logissue type=error]Raw SQL detected (constitution violation)"
                  exit 1
                fi

  - stage: Build
    displayName: 'Build and Test'
    dependsOn: Validate
    jobs:
      - job: BuildAndTest
        displayName: 'Build & Test'
        steps:
          - checkout: self
          
          - task: UseDotNet@2
            displayName: 'Setup .NET'
            inputs:
              version: $(dotnetVersion)
              
          - task: DotNetCoreCLI@2
            displayName: 'Restore packages'
            inputs:
              command: 'restore'
              projects: '**/*.csproj'
              
          - task: DotNetCoreCLI@2
            displayName: 'Build solution'
            inputs:
              command: 'build'
              projects: '**/*.csproj'
              arguments: '--configuration $(buildConfiguration) --no-restore'
              
          - task: DotNetCoreCLI@2
            displayName: 'Run tests with coverage'
            inputs:
              command: 'test'
              projects: '**/*Tests.csproj'
              arguments: '--configuration $(buildConfiguration) --no-build --collect:"XPlat Code Coverage" --results-directory $(Build.SourcesDirectory)/TestResults'
              
          - task: PublishCodeCoverageResults@2
            displayName: 'Publish coverage report'
            inputs:
              summaryFileLocation: '$(Build.SourcesDirectory)/TestResults/**/coverage.cobertura.xml'
              
          - task: Bash@3
            displayName: 'Enforce coverage threshold'
            inputs:
              targetType: 'inline'
              script: |
                # Constitution requires 80% coverage
                coverage_file=$(find $(Build.SourcesDirectory)/TestResults -name "coverage.cobertura.xml" | head -1)
                if [ -f "$coverage_file" ]; then
                  coverage=$(grep -oP 'line-rate="\K[^"]+' "$coverage_file" | head -1)
                  threshold=0.80
                  if (( $(echo "$coverage < $threshold" | bc -l) )); then
                    echo "##vso[task.logissue type=error]Coverage $coverage is below $threshold threshold"
                    exit 1
                  fi
                  echo "Coverage: $coverage (threshold: $threshold) ✓"
                fi

  - stage: Security
    displayName: 'Security Scanning'
    dependsOn: Build
    jobs:
      - job: SecurityScan
        displayName: 'Dependency & SAST Scan'
        steps:
          - checkout: self
          
          - task: UseDotNet@2
            inputs:
              version: $(dotnetVersion)
              
          - task: DotNetCoreCLI@2
            displayName: 'Check vulnerable packages'
            inputs:
              command: 'custom'
              custom: 'list'
              arguments: 'package --vulnerable --include-transitive'
              
          # If you have Microsoft Defender for DevOps or SonarCloud
          - task: MicrosoftSecurityDevOps@1
            displayName: 'Microsoft Security DevOps'
            continueOnError: true

  - stage: DeployStaging
    displayName: 'Deploy to Staging'
    dependsOn: Security
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - deployment: DeployStaging
        displayName: 'Deploy to Staging'
        environment: 'staging'
        strategy:
          runOnce:
            deploy:
              steps:
                - task: AzureWebApp@1
                  displayName: 'Deploy to Azure App Service'
                  inputs:
                    azureSubscription: '$(azureServiceConnection)'
                    appType: 'webApp'
                    appName: '$(stagingAppName)'
                    package: '$(Pipeline.Workspace)/**/*.zip'