CI/CD & GitHub Automation
Relevant source files
The following files were used as context for generating this wiki page:
The CI/CD and GitHub Automation system manages the lifecycle of code from development to production through automated pipelines, quality gates, and GitHub Actions integration. This system ensures that all deployments meet strict Enterprise Governance standards, including automated safety checks, security scanning, and infrastructure orchestration.
Sources: nexifyai-github-prompt.prompt.yml, README.md, services/api/agents/brain_agents/senior-quality-auditor.md:1-15
Core Automation Components
The project utilizes specialized scripts and automated agents to manage the deployment pipeline. These tools automate scaffolding, analysis, and production-grade deployments.
Automation Tooling
The system provides three primary Python-based automation tools:
| Tool | Script Path | Primary Features |
|---|---|---|
| Pipeline Generator | scripts/pipeline_generator.py | Automated scaffolding, configurable templates, and quality checks. |
| Terraform Scaffolder | scripts/terraform_scaffolder.py | Deep infrastructure analysis, performance metrics, and automated fixes. |
| Deployment Manager | scripts/deployment_manager.py | Expert-level automation and custom production configurations. |
Sources: nexifyai-github-prompt.prompt.yml:15-55
GitHub Action Workers
The worker/githubAutomation.js utility processes GitHub events to automate pull request (PR) management. It classifies PRs based on risk and enables native GitHub auto-merge via GraphQL if safety criteria are met.
This diagram shows the logic flow for processing incoming GitHub webhooks and determining automation actions.
Sources: worker/githubAutomation.js:10-100
Quality Gates and Auditing
The senior-quality-auditor agent enforces strict quality gates that a system must pass before reaching production. This ensures compliance with the "12-System founder mandate."
Mandatory Quality Gates
Deployments are evaluated against seven specific gates:
- Documentation: Architecture specs, API docs, and decision records must exist.
- Testing: Unit tests must have ≥80% coverage for P0 systems.
- Security: Secrets must be in vaults, and security scans must show no CVEs.
- Architecture: Changes must fit the 12-System model and scaling plans.
- Performance: API latency must be <200ms p95.
- Workflow: Every task must be tracked in the order-workflow system.
- Agent Quality: AI agent profiles must meet minimum character lengths (e.g., ≥4000 chars).
Sources: services/api/agents/brain_agents/senior-quality-auditor.md:21-70
Automated Gate Checks
While documentation and architecture require manual oversight, gates 5 through 7 are automated. The system scrapes /api/health metrics and validates agent profiles against the brain_agents/ directory structure.
Sources: services/api/agents/brain_agents/senior-quality-auditor.md:105-115
CI/CD Workflow Execution
The CI/CD pipeline is visualized through status badges and health dashboards, providing real-time visibility into the automation status.
Workflow Monitoring
The system monitors four primary workflows:
- Security Scan: Executes
security-scan.ymlon push. - CI Quality Gates: Executes
ci.ymlto validate code against quality standards. - Tests: Runs automated test suites via
test.yml. - Vercel Deploy: Handles the final deployment through
deploy.yml.
Sources: apps/web/public/health.html:85-110, README.md:1-25
Task Generation from CI Failures
The Autonomous Task Generator monitors the environment and generates tasks based on CI/CD results or system deviations.
This diagram illustrates how the system autonomously reacts to pipeline failures by creating actionable tasks for AI agents.
Sources: services/api/brain/autonomous_task_gen.py:15-80
Implementation Details
Auto-Merge Logic
The worker/githubAutomation.js implements a safety classification system. It checks for positive eligibility (e.g., bot PRs, dependency updates) while explicitly blocking PRs with critical labels like security, bug, or secret-leak.
// worker/githubAutomation.js:18-45
const SAFE_LABELS = new Set(["auto-merge", "dependencies", "docs-only", "governance", "ci"]);
const BLOCKING_LABELS = new Set(["security", "bug", "blocked", "needs-review", "needs-triage", "secret-leak"]);
const SAFE_BOTS = new Set(["dependabot[bot]", "renovate[bot]", "github-actions[bot]"]);
async function isSafeForAutoMerge(pullRequest, labels) {
const author = pullRequest.user.login;
const labelNames = labels.map((l) => (typeof l === "string" ? l : l.name));
const hasAutoMergeLabel = labelNames.includes("auto-merge");
const isBotPR = SAFE_BOTS.has(author);
// Returns { safe: true, method: "squash" } if conditions met
}
Sources: worker/githubAutomation.js:18-60
Summary
The CI/CD & GitHub Automation system serves as the operational backbone of NeXifyAI. By integrating script-based generators, automated quality auditors, and intelligent GitHub workers, the platform ensures that code is consistently tested, secured, and deployed. This autonomous approach reduces technical debt and maintains enterprise-level compliance across all repository interactions.
Sources: README.md:50-70, services/api/agents/brain_agents/senior-quality-auditor.md:150-160