Software Development Skills

ActionMailer baseline for Rails 8 — mailer setup, deliverlater by default (never delivernow in the request path), Mailer previews in dev, mailer specs with RSpec, Letter Opener for dev inspection, transactional delivery via Postmark / SendGrid / SES / Mailgun, bounce and complaint handling, idempotent transactional sends, attachments and inline images, i18n for subject lines and bodies. Use when the user mentions ActionMailer, mailers, deliverlater, delivernow, mailer previews, transactional email, Postmark, SendGrid, SES, Mailgun, bounces, mailer specs, Letter Opener, or asks how to send email from Rails.

Action Text (rich text) in Rails 8 — Trix editor integration, hasrichtext on models, Active Storage for embedded attachments, the safe-list of HTML tags, custom embeds via attachable mixin, server-side sanitization, XSS prevention, search indexing of plain text. Use when the user mentions Action Text, Trix, rich text editor, hasrichtext, WYSIWYG, formatted text content, embedded images, or asks how to add a rich text editor to Rails.

File uploads in Ruby on Rails 8 with Active Storage — direct uploads to S3/GCS (skip the Rails server for the byte payload), variant configuration with imageprocessing + libvips, content-type and size validation, pre-signed URL safety (short TTLs, no public buckets by default), analyzer / previewer hooks, processing variants in background jobs (not the request thread), the service config for dev/test/prod. Use when the user mentions Active Storage, file uploads, attach, hasoneattached, hasmanyattached, direct uploads, image variants, S3, GCS, imageprocessing, libvips, signed URLs, or asks how to handle avatars / attachments / photo uploads in Rails.

Integrate Angular with a Ruby on Rails app — classical API + SPA as the default (Angular's full-framework model doesn't fit Inertia well), standalone-components Angular 17+, NgRx vs signals, JWT auth flow, CORS configuration, deploying Angular separately from Rails. Use when integrating Angular into Rails, the user mentions Angular CLI, NgRx, standalone components, Angular signals, or asks "how do I use Angular with Rails".

Asset pipeline for Rails 8 — Propshaft as the new default (replacing Sprockets), Importmap-rails for JS without bundling, jsbundling-rails for esbuild/rollup/webpack, cssbundling-rails for Tailwind/Sass/PostCSS, the Sprockets-to-Propshaft migration, asset host for CDN, digest stamping, far-future expiry headers. Use when the user mentions Propshaft, Sprockets migration, importmap, jsbundling, cssbundling, assethost, asset pipeline, .css.erb, manifest.js, or asks about Rails 8 assets.

Change Data Capture (CDC) from a Rails Postgres database via Debezium into Kafka topics — logical replication setup, wallevel=logical, REPLICA IDENTITY FULL, publication / replication slot, Debezium Connect config, transformations, snapshot mode, schema evolution, when CDC fits vs application-emitted events. Use when the user mentions Debezium, CDC, change data capture, logical replication, wal2json, pglogical, "stream DB changes to Kafka", or wants downstream systems (search index, data warehouse) updated from Rails DB writes.

GitHub Actions CI/CD for Rails 8 — RSpec, Brakeman, RuboCop, bundle audit, system specs with Cuprite, parallel matrix tests, caching gems and nodemodules, Kamal deploy job gated on green main, OIDC + AWS / GCP without long-lived keys, branch protection rules. Use when the user mentions GitHub Actions, GHA, CI, workflow, .github/workflows, deploy via GitHub, OIDC, push protection, or asks how to set up CI for a Rails app.

GitLab CI/CD for Rails 8 — .gitlab-ci.yml structure, RSpec + lint + security parallel stages, cache strategy (bundler, yarn, assets), services keyword for Postgres + Redis, Auto DevOps caveats, deploy via Kamal or AutoDevOps, OIDC for cloud credentials, environments + protected branches. Use when the user mentions GitLab CI, .gitlab-ci.yml, runners, Auto DevOps, GitLab Runner, or is on GitLab and asks how to set up CI for a Rails app.

Jenkins for Rails — Jenkinsfile (declarative pipeline) for RSpec, lint, security, deploy. Agents, credentials, parallel stages, the Blue Ocean UI. Counter-position. If you're greenfield in 2026, prefer GitHub Actions or GitLab CI; Jenkins is for enterprise / on-prem requirements where managed CI isn't allowed. Use when the user mentions Jenkins, Jenkinsfile, declarative pipeline, Blue Ocean, Jenkins agents, or is constrained to self-hosted CI in an enterprise environment.

Production console safety in Rails 8 — the production console warning, sandbox mode, read-only consoles, audit logging of console sessions, scrubbing PII, dangerous methods to never run (updateall, deleteall, truncate, raw SQL DELETE/UPDATE without WHERE), the staged-production-console pattern, replacing console with rake tasks. Use when the user mentions production console, rails c, console safety, sandbox, web-console, rails db, dangerous Rails commands, scrubbing data, or asks how to safely operate a production Rails app.

Syncing Rails Postgres to a data warehouse (Snowflake, BigQuery, Redshift) — Fivetran / Airbyte / Hightouch / Stitch / Census / CDC via Debezium, when ELT beats ETL, dbt for transformation, reverse-ETL to push warehouse data back into ops tools, schemas for analytics vs OLTP, when to add columns vs separate tables, PII isolation in the warehouse. Use when the user mentions data warehouse, Snowflake, BigQuery, Redshift, dbt, Fivetran, Airbyte, Hightouch, Census, reverse ETL, "analytics on top of our Rails DB", or wants BI tooling on Rails data.

Migrate a Ruby on Rails application's primary database from MySQL to PostgreSQL — schema upgrades (JSON to JSONB for queryability, ENUMs to native types or check constraints, TINYINT to BOOLEAN, case-sensitivity changes), data export/import via pgloader, the dual-write cutover pattern, the gem switch (mysql2/trilogy to pg), Rails-side caveats. Use when migrating from MySQL to Postgres, the user mentions pgloader, JSONB upgrade, ENUM migration, TINYINT to BOOLEAN, or asks how to move a Rails app to Postgres.

Migrate a Ruby on Rails application from Oracle Database to PostgreSQL — schema differences (NUMBER to BIGINT/DECIMAL, VARCHAR2 to VARCHAR, CLOB/BLOB to TEXT/BYTEA, sequences, ROWID, hierarchical queries, PL/SQL packages), Oracle Enhanced adapter to pg gem, data migration via ora2pg, the dual-write cutover. Use when leaving Oracle for Postgres, the user mentions ora2pg, Oracle Enhanced adapter, NUMBER columns, VARCHAR2, sequences, ROWNUM, CONNECT BY, or asks how to escape Oracle.

Migrate a Ruby on Rails application's primary database from PostgreSQL to MySQL — schema differences (JSONB to JSON, ARRAY columns, partial indexes, CHECK constraints, sequences), data export/import via pgdump and mysqlimport or pgloader, the dual-write cutover pattern, the gem switch (pg to mysql2 or trilogy), Rails-side caveats. Use when migrating a Rails app from Postgres to MySQL, the user mentions pgloader, mysql2, trilogy, schema conversion, JSONB to JSON, ARRAY columns, partial indexes, or asks how to move a Rails app off Postgres.

Authentication and authorization for Ruby on Rails — Devise + Pundit as the default monolith combo, Rodauth when Devise hits its limits (MFA, WebAuthn, advanced password policies), devise-jwt for API-only apps, Rails 8's built-in bin/rails generate authentication for simple cases, secure defaults checklist (confirmable, lockable, password complexity), Pundit policy structure, the scope pattern for index actions, common authorization smells. Use when adding sign-in / sign-up, the user mentions Devise, Pundit, Rodauth, JWT auth, authorization, policies, can-can, CanCanCan, role-based access, MFA, WebAuthn, or asks "how do I auth in Rails".

Distributed tracing for Rails — OpenTelemetry SDK + auto-instrumentation, trace + span model, context propagation across HTTP / Sidekiq / Kafka, baggage, sampling strategies, exporters (OTLP to Tempo / Jaeger / Honeycomb / Datadog / Lightstep), correlating traces with logs via traceid, when tracing matters more than logs/metrics. Use when the user mentions OpenTelemetry, OTel, distributed tracing, traces, spans, Jaeger, Tempo, Honeycomb, Datadog APM, "follow a request across services", or has microservices and needs cross-service debugging.

Integrate Ruby on Rails apps with external HTTP APIs — Faraday as the canonical client, retries with exponential backoff, circuit breaker (Stoplight), VCR for tests, timeout discipline (open + read), structured logging of API calls, idempotency keys on writes, rate limit handling, the wrap-in-a-service-object pattern. Use when the user mentions Faraday, HTTP client, API integration, retries, circuit breaker, Stoplight, VCR cassettes, HTTPX, Net::HTTP, or asks how to call a third-party API safely.

Architectural patterns beyond fat models — form objects for multi-model form binding, query objects for complex AR querying, presenters / decorators for view logic. When each earns its keep, naming, testing, common smells. Use when models bloat, forms span multiple models, queries get hard to read, views accumulate helpers, or the user mentions Reform, ActiveModel::Model, decorators, Draper, presenters, query objects.

GDPR compliance for Rails apps — DSAR (Data Subject Access Request) export, right to erasure, lawful basis, consent management, data minimisation, processor vs controller responsibilities, DPAs with vendors, breach notification within 72 hours, cookie consent (and when you don't need a banner), pseudonymisation vs anonymisation, audit logs that survive erasure. Use when the user mentions GDPR, DSAR, "right to be forgotten", consent banner, cookie law, CCPA, lawful basis, data subject, EU users, data protection.

HIPAA compliance for Rails apps handling PHI (Protected Health Information) — Active Record Encryption for PHI at rest, audit logs that survive deletion, access controls (RBAC), Business Associate Agreements (BAAs) with cloud providers, breach detection, the 18 HIPAA identifiers, when NOT to handle PHI in your app. Use when the user mentions HIPAA, PHI, ePHI, medical records, healthcare app, BAA, audit log, Privacy Rule, Security Rule, or asks "can our Rails app store medical info." This skill encodes engineering controls — it does not replace legal counsel.

Internationalization and time zones in Rails 8 — I18n keys for translations, locale fallbacks, lazy lookup in views, locale switching per-request, the rails-i18n gem, time zone storage strategy (UTC in DB, display in user's zone), Time.zone vs Time.current vs Time.now, timeinzone, daylight saving traps. Use when the user mentions I18n, locales, translations, t() helper, Time.zone, Time.current, time zone, DST, multi-language, or asks how to localize a Rails app.

Apache Kafka in Rails — producing and consuming with karafka (recommended), racecar as a thin alternative, ruby-kafka legacy notes, schema management with Avro/Protobuf, partitioning strategy, consumer group offsets, exactly-once vs at-least-once delivery semantics, idempotent consumers, the outbox pattern for transactional publish. Use when the user mentions Kafka, karafka, racecar, ruby-kafka, event streaming, Confluent, MSK, schema registry, partitions, consumer group, or asks how to publish/consume events at scale from Rails.

Production Docker and Kamal 2 deployment for Ruby on Rails 8 — multi-stage Dockerfile with build/runtime separation, ruby:3.x-slim over alpine (avoiding musl gotchas with nokogiri/pg/sassc), docker-compose for development with Postgres + Redis, Kamal 2 deploy.yml, zero-downtime via Kamal Proxy and the GET /up health check, secrets via Kamal envs + Rails credentials, log shipping. Use when writing or reviewing a Dockerfile for Rails, setting up Kamal, debugging deploy failures, the user mentions Dockerfile, docker-compose, Kamal, Kamal Proxy, Thruster, multi-stage builds, alpine vs slim, native gem compilation, kamal deploy, zero-downtime, or asks how to ship a Rails 8 app to production.

Decomposing a Rails monolith into services — bounded contexts, service boundaries, public-API contracts, ownership of data, service-to-service authentication, the "shared library" trap, distributed-transaction patterns (saga, outbox), how to NOT recreate the monolith over HTTP. Use ONLY after the user has answered YES to the gating questions in when-NOT-to-use-microservices. Use when the user asks how to split the monolith, where to draw service lines, bounded contexts, DDD aggregates, service-to-service auth, or has 50+ engineers and is past the modular-monolith stage.