Docs — Study Guides for Every Public Repo
Start here
These guides turn four GitHub READMEs into something you can actually study on a phone: plain-English concept first, a 5-minute quickstart, the full CLI reference, how the code fits together, and copy-paste labs. No laptop required to understand; a laptop (or Termux) required only for the labs.
| Repo | What it is | Study time |
|---|---|---|
| pdpa-sg-clj | Singapore PDPA compliance-as-code toolkit: scan, redact, checklist, policy templates | 30 min |
| identity-control-plane | Ephemeral workload credentials (300s TTL) + tamper-evident transaction log | 20 min |
| idira-audit-clj | IAM/PAM audit CLI: orphaned privilege, dormant accounts, missing MFA, stale tokens | 20 min |
| identity-policy-as-code | OPA/Rego gate that denies wildcard IAM over Terraform plans, in CI | 15 min |
Suggested order
- identity-policy-as-code — smallest idea (deny bad IAM before it ships). Builds intuition for everything else.
- idira-audit-clj — the detective side: find bad access that already exists.
- pdpa-sg-clj — the compliance side: PDPA obligations as runnable checks. The flagship; biggest guide.
- identity-control-plane — the advanced piece: short-lived machine credentials + chained audit log.
Conventions used in every guide
- Commands are copy-pasteable.
bb <task>means Babashka — one static binary, no JVM install dance. - Deterministic first. Every tool prints the same output for the same input. Tests assert exact findings, not vibes.
- Verify, don’t trust. Each lab ends with the exact output that proves it worked.
- Source of truth is GitHub. Code:
https://github.com/nurazhardotcom/<repo>. These pages teach; the repo decides.
Excluded
n8n-workflows (a disabled upstream fork, not authored
here) has no guide. Everything else public is above.