# Resources — Platform Add-ons (the operational toolkit)

High-trust only. External sources are the canon for each tool/pattern; in-repo sources are ground
truth for how *this* platform uses them. Never trust parametric memory over these.

## Primary sources (external — verified)

### Migrations
- **golang-migrate** — <https://github.com/golang-migrate/migrate> · migration file format:
  <https://github.com/golang-migrate/migrate/blob/master/MIGRATIONS.md>
  `{version}_{title}.up.{ext}` / `.down.{ext}`; versions applied upward by increasing number.

### Linting & githooks
- **golangci-lint** — <https://golangci-lint.run/docs/> (config, linters, settings).
- **sqlclosecheck** (the upstream linter the repo's *custom* analyzer echoes) —
  <https://github.com/ryanrolds/sqlclosecheck> — "confirms DB rows/statements are closed; unclosed
  rows can exhaust the connection pool."
- **gitleaks** — <https://github.com/gitleaks/gitleaks> — secret scanner; `.gitleaks.toml`;
  `gitleaks protect --staged` (pre-commit) and `gitleaks git` (CI/history).

### Secrets
- **SOPS** — <https://getsops.io/docs/> · <https://github.com/getsops/sops> — encrypts *values* with
  AES-256-GCM; the data key is wrapped by a KMS (here **GCP KMS**). CNCF project (ex-Mozilla).

### Build / Skaffold
- **Skaffold** — <https://skaffold.dev/docs/> — build/tag/deploy loop for k8s; `skaffold dev`/`run`;
  profiles; custom build commands.

### Reliability patterns (the interview-classic trio)
- **Transactional outbox** — Chris Richardson —
  <https://microservices.io/patterns/data/transactional-outbox.html> — atomically update the DB and
  "send" a message by inserting into an outbox table in the same tx; a relay ships it. Solves the
  **dual-write problem**.
- **Idempotent consumer** — Chris Richardson —
  <https://microservices.io/patterns/communication-style/idempotent-consumer.html> — record processed
  message IDs; detect and discard duplicates (message brokers deliver at-least-once).
- **Polling publisher / CDC as relay** —
  <https://microservices.io/patterns/data/polling-publisher.html> and the CDC course (Debezium is this
  repo's outbox relay).

### Notification & email delivery
- **SendGrid v3 Mail Send + Event Webhook** —
  <https://www.twilio.com/docs/sendgrid/api-reference> ·
  <https://www.twilio.com/docs/sendgrid/for-developers/tracking-events/event> — `processed`,
  `delivered`, `bounce`, `dropped`; `custom_args` echoed back on the webhook.
- **Firebase Cloud Messaging (Admin SDK)** —
  <https://firebase.google.com/docs/cloud-messaging/send/admin-sdk> · Go SDK
  <https://pkg.go.dev/firebase.google.com/go/messaging> — `SendMulticast`/`SendEachForMulticast`, up
  to **500 tokens** per multicast, `BatchResponse` with per-token success/failure.

### Cron / scheduled jobs
- **Kubernetes CronJob** — <https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/> —
  cron-schedule-driven Jobs (the repo schedules via Helm-rendered CronJobs, not an in-process scheduler).
- **KEDA** — <https://keda.sh/docs/latest/> — event-driven autoscaling; the repo scales the consumer
  pod on Kafka consumer-group lag via a Prometheus trigger.

## In-repo ground truth (the real spec)
- `.claude/skills/migration/SKILL.md` — the migration recipe (`NNNN_migrate.up.sql`, RLS boilerplate,
  `make gen-db-schema`).
- `.claude/rules/sqlc-queries.md`, `.claude/rules/security.md` — schema paths; RLS/`resource_path`/
  soft-delete rules migrations must honour.
- `.golangci.yaml`, `.gitleaks.toml`, `.githooks/`, `cmd/custom_lint/` — the lint/hook config + the
  bespoke analyzer.
- `.sops.yaml`, `internal/golibs/configs/load.go`, `internal/golibs/crypt/` — the secret flow.
- `skaffold.*.yaml`, `local/build-code-golang.bash`, `developments/*.Dockerfile` — the build system.
- `internal/golibs/outboxevents/`, `deployments/docs/outbox_pattern.md` — the outbox.
- `internal/golibs/{kafka,nats,try}/`, `internal/notification/services/idempotent.go` — retries + idempotency.
- `internal/spike/modules/email/`, `internal/notification/{services,infra,transports}/`,
  `internal/golibs/{sendgrid,firebase}/` — delivery.
- `internal/golibs/bootstrap/command.go`, `cmd/server/notificationmgmt/cronjob_*.go`,
  `deployments/helm/backend/notificationmgmt/` — the cron/jobs framework.

## Reference (in this workspace)
- [reference/repo-toolkit-map.md](reference/repo-toolkit-map.md) — the ground-truth map for all seven
  topics, with `file:line`.
- [reference/GLOSSARY.md](reference/GLOSSARY.md) — canonical vocabulary.
- [reference/cheat-sheet.md](reference/cheat-sheet.md) — the recipes + interview one-liners.

## Community (for wisdom)
- **r/golang**, **Gophers Slack** (`#sql`, `#kubernetes`, `#security`) — <https://invite.slack.golangbridge.org/>
- **CNCF Slack** (`#sops`, `#keda`) — <https://slack.cncf.io/>
- **microservices.io / Chris Richardson** — the canonical reference for the reliability patterns.