python scripts/workflow_generator.py --type ci --language python --test-framework pytest

python scripts/pipeline_analyzer.py path/to/.github/workflows/

python scripts/deployment_planner.py --type webapp --environments dev,staging,prod

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run linter
        run: make lint

  test:
    needs: lint
    strategy:
      matrix:
        python-version: ['3.10', '3.11', '3.12']
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - run: pip install -r requirements.txt
      - run: pytest --junitxml=results.xml
      - uses: actions/upload-artifact@v4
        with:
          name: test-results-${{ matrix.python-version }}
          path: results.xml

  security:
    needs: lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Dependency audit
        run: pip-audit -r requirements.txt

Build -> Dev (auto) -> Staging (auto) -> Production (manual approval)
                                              |
                                        Canary (10%) -> Full rollout

env:
  REGISTRY: ghcr.io/${{ github.repository_owner }}

jobs:
  deploy:
    strategy:
      matrix:
        environment: [dev, staging, production]
    environment: ${{ matrix.environment }}
    runs-on: ubuntu-latest
    steps:
      - name: Deploy
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
          API_KEY: ${{ secrets.API_KEY }}
        run: |
          ./deploy.sh --env ${{ matrix.environment }}

on:
  push:
    paths:
      - 'src/**'
      - 'tests/**'
      - 'requirements*.txt'
    paths-ignore:
      - 'docs/**'
      - '*.md'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

strategy:
  fail-fast: false
  matrix:
    os: [ubuntu-latest, macos-latest, windows-latest]
    node-version: [18, 20, 22]
    exclude:
      - os: windows-latest
        node-version: 18
    include:
      - os: ubuntu-latest
        node-version: 22
        experimental: true

jobs:
  prepare:
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - id: set-matrix
        run: echo "matrix=$(jq -c . matrix.json)" >> "$GITHUB_OUTPUT"

  build:
    needs: prepare
    strategy:
      matrix: ${{ fromJson(needs.prepare.outputs.matrix) }}

- uses: actions/cache@v4
  with:
    path: |
      ~/.cache/pip
      ~/.npm
      ~/.cargo/registry
    key: ${{ runner.os }}-deps-${{ hashFiles('**/requirements.txt', '**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-deps-

- uses: docker/build-push-action@v5
  with:
    context: .
    cache-from: type=gha
    cache-to: type=gha,mode=max
    push: true
    tags: ${{ env.IMAGE }}:${{ github.sha }}

- uses: actions/upload-artifact@v4
  with:
    name: build-output
    path: dist/
    retention-days: 5

undefined

permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789:role/github-actions
      aws-region: us-east-1

undefined

**Calling a reusable workflow:**

```yaml
jobs:
  deploy-staging:
    uses: ./.github/workflows/reusable-deploy.yml
    with:
      environment: staging
      image_tag: ${{ github.sha }}
    secrets:
      DEPLOY_KEY: ${{ secrets.STAGING_DEPLOY_KEY }}

undefined

---

---
name: code-review-agent
description: Automated code review with context-aware feedback
triggers:
  - pull_request
tools:
  - code-search
  - file-read
  - comment-create
permissions:
  pull-requests: write
  contents: read
safe-outputs: true
---

undefined

lint:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - name: Python lint
      run: |
        pip install ruff
        ruff check .
        ruff format --check .
    - name: YAML lint
      run: |
        pip install yamllint
        yamllint .github/workflows/

security:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4

    - name: SAST - Static analysis
      uses: github/codeql-action/analyze@v3

    - name: Dependency audit
      run: |
        pip-audit -r requirements.txt
        npm audit --audit-level=high

    - name: Container scan
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: ${{ env.IMAGE }}:${{ github.sha }}
        severity: CRITICAL,HIGH

benchmark:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - name: Run benchmarks
      run: python -m pytest benchmarks/ --benchmark-json=output.json
    - name: Compare with baseline
      run: python scripts/compare_benchmarks.py output.json baseline.json --threshold 10

1. Deploy new version to "green" environment
2. Run health checks on green
3. Switch load balancer to green
4. Monitor for errors (5-15 minutes)
5. If healthy: decommission old "blue"
   If unhealthy: switch back to blue (instant rollback)

1. Deploy canary (new version) alongside stable
2. Route 5% traffic to canary
3. Monitor error rates, latency, business metrics
4. If healthy: increase to 25% -> 50% -> 100%
   If unhealthy: route 100% back to stable

undefined

undefined

undefined

**Benefits:**

- Deploy code without exposing it to users.
- Gradual rollout by user segment (internal, beta, percentage).
- Instant kill switch without redeployment.
- A/B testing capability.

---

undefined

undefined

undefined

---

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15  # Hard limit

Formula:
  Monthly minutes = (runs/day) x (avg minutes/run) x 30
  Monthly cost = Monthly minutes x (cost/minute)

Example:
  50 pushes/day x 8 min/run x 30 days = 12,000 minutes
  12,000 x $0.008 = $96/month (2-core Linux)

undefined

undefined

undefined

undefined

undefined

---

Is zero-downtime required?
  No  -> Rolling deployment
  Yes ->
    Need instant rollback?
      No  -> Rolling with health checks
      Yes ->
        Budget for 2x infrastructure?
          Yes -> Blue-green
          No  ->
            Can handle complexity of traffic splitting?
              Yes -> Canary
              No  -> Blue-green with smaller footprint

Job duration > 20 minutes on 2-core?
  No  -> Use 2-core (cheapest)
  Yes ->
    CPU-bound (compilation, tests)?
      Yes -> 4-core or 8-core (cut time in half)
      No  ->
        I/O bound (downloads, Docker)?
          Yes -> 2-core is fine, optimize caching
          No  -> Profile the job to find the bottleneck