OpenParable
Skip to content
← Back to skills

Production Standards

DevOps & Security
production-standards

Production Standards is an Agent Skill for devops & security published in the liferay/liferay-portal repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Production guardrails applied when generating or modifying any code or configuration intended for a nonlocal environment (UAT, prod, customer facing deploys). Use whenever the agent's output may reach a higher environment — to enforce state integrity, secret management, and security preserving debugging practices.

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/liferay/liferay-portal/blob/HEAD/workspaces/clarity-solution-workspace/.workspace-rules/skills/production-standards/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/production-standards, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Liferay Production Rules

Configuration and State Integrity

  • State Integrity (Source of Truth): configuration is the source of truth for version control — never mutate the runtime directly. For Tomcat, this is configs/local/portal-ext.properties; copy to bundles/portal-ext.properties and restart to apply. For Docker with a prebuilt image, this is liferay.env (env vars); changes require a container restart. For Docker with a custom image, this is configs/docker/portal-ext.properties; changes require rebuilding the image.
  • No Silent Edits to Runtime: never modify the live runtime state (e.g., bundles/portal-ext.properties) without explicitly announcing the change in your response. Edits that propagate from configs/[env]/ via the normal sync flow are preferred.
  • No Security Disabling Debug Shortcuts: never set portal.security.manager.strategy=none, disable CSRF enforcement, or otherwise weaken security as a debugging shortcut — even temporarily. If a 403 cannot be resolved through Roles, Permissions, or OAuth2 scope configuration, declare it a blocker and surface it to the user rather than disabling the protection.

Production Deployment Guardrails

  • Environment Specific Configs: mandate configs/prod/ or configs/uat/ for environment properties; these must be bundled into Docker images / Liferay Cloud builds, not hot deployed via Blade.
  • Secret Management: explicitly forbid hardcoded credentials. Mandate Liferay's Secret Management or environment variables (e.g., ${env.SECRET_NAME}).
  • Performance & Caching: mandate proper caching headers for custom endpoints / Client Extensions, and use of Liferay.Util.fetch to route through authenticated caching layers.