odoo-harden

Files (1)

• SKILL.md

SKILL.md (first lines)

# Odoo Harden

Run a zero-tolerance hardening pass on the **entire project** before go-live.

This skill:
1. Detects project context (version, edition, all modules in `addons/`)
2. Creates a `project-hardening` change using the `harden-driven` openspec schema
3. Generates `audit.md` — full automated scan of every file in `addons/`
4. Generates `harden-tasks.md` — remediation checklist for every finding
5. Executes all tasks autonomously via `openspec-apply-change`
6. Runs the mandatory infrastructure sequence (rebuild, tests, translations, user setup, smoke)
7. Reports completion to the user

**Scope:** The entire `addons/` directory — not any specific change.
**Zero tolerance:** Nothing is pre-existing. Every finding gets fixed.
**No pauses:** Run to completion, then list any unresolvable issues at the end.

---

## Before You Begin

Read the full hardening reference:

```
~/.config/opencode/odoo/reference-phase2.md
```

This contains all 10 audit categories, workflows, and the completion report template.

---

## Workflow

### Step 1: Detect Project Context

```bash
# Odoo version
grep "image: odoo" docker-compose.yml | grep -oE '[0-9]+\.[0-9]+'

# Edition (CE or EE)
grep -q "enterprise" docker-compose.yml && echo "EE" || echo "CE"

# Container name
grep "container_name:" docker-compose.override.yml 2>/dev/null | awk '{print $2}' || \
grep "container_name:" docker-compose.yml | awk '{print $2}'

# Database name (always read from odoo.conf)
grep "^db_name" odoo.conf | awk -F' = ' '{print $2}'

# All modules to harden
ls addons/

# Shared source path
ls ~/shared/odoo-src/<version>/
```

Announce detected context before proceeding.

### Step 2: Create the Hardening Change

```bash
openspec new change "project-hardening" --schema harden-driven
```

If a `project-hardening` change already exists (interrupted previous run), ask the
user whether to resume it or start fresh.

### Step 3: Generate Artifacts (Propose Phase)

Load and execute the propose skill:

```
skill({ name: "openspec-propose" })
```

This will:
- Generate `audit.md`: the agent reads every file in `addons/` and records
  all findings across the 10 categories from `reference-phase2.md`
- Generate `harden-tasks.md`: one task per finding plus the mandatory
  infrastructure section

**Audit stance:** Read EVERY file. No shortcuts. No assumptions.
The shared Odoo source at `~/shared/odoo-src/<version>/` must be consulted
for any Category 10 (Standard Pattern Compliance) findings before flagging them.

Reuse the house-rule and security skills instead of re-deriving rules per finding:

```
skill({ name: "odoo-review" })     # guidelines + security pass over the changed files
skill({ name: "odoo-security" })   # focused audit: access, sudo, SQL, RPC, XSS
skill({ name: "odoo-guidelines" }) # addon house rules behind the audit categories
```

### Step 4: Execute All Tasks (Apply Phase)

Load and execute the apply skill:

```
skill({ name: "openspec-apply-change" })
```

Work through every task in `harden-tasks.md`:

- Fix everything autonomously
- Do not pause to ask the user about any finding
- For `cr.commit()` findings: read context and comments carefully;
  never blindly remove; add a comment if justified but undocumented
- For standard pattern replacements: read the actual source in
  `~/shared/odoo-src/<version>/` before refactoring; only replace if the
  standard API genuinely covers the use case
- For OCA dep additions: verify the module exists in `~/shared/odoo-src/<version>/oca/`
  before adding it to `depends`
- For method length violations: extract to private methods, preserve all behavior

**After all non-infrastructure tasks are complete**, execute the mandatory
infrastructure sequence in this order:

#### 5a. Version Bump
Increment patch version in every modified `__manifest__.py`.

From sozialinfo/opencode, MIT.

More from sozialinfo/opencode