feat: Initial open-source release of Watchflow AI governance engine · warestack/watchflow@4f76571 · GitHub
Skip to content

Commit 4f76571

Browse files
dkargatzisdkargatzis
committed
feat: Initial open-source release of Watchflow AI governance engine
BREAKING CHANGE: This is the first public release of Watchflow # Core Features - AI-powered GitHub workflow monitoring and enforcement - Multi-agent system using LangGraph for intelligent rule evaluation - Natural language rule definitions with YAML configuration - Real-time webhook processing for GitHub events - Intelligent acknowledgment system for policy violations - Feasibility analysis for rule implementation # Technical Architecture - Stateless, event-driven FastAPI application - Kubernetes-ready with Helm charts for EKS deployment - Docker containerization with multi-stage builds - GitHub App integration with webhook authentication - OpenAI GPT-4 integration for AI agent reasoning - LangSmith integration for agent debugging and tracing # Development Infrastructure - Complete CI/CD pipeline with GitHub Actions - Automated EKS deployment with proper secret management - Development environment with ngrok for local testing - Comprehensive documentation and contribution guidelines - Professional markdown documentation following markdownlint standards # Security & Configuration - Environment-based configuration management - Secure secret handling for GitHub App credentials - CORS configuration for webhook endpoints - Proper authentication and authorization flows # Documentation - Professional README with problem/solution overview - Development setup guide with prerequisites - Contributing guidelines for open-source collaboration - Architecture documentation for technical decisions - AI agents documentation explaining the multi-agent system This release establishes Watchflow as a production-ready, intelligent governance solution that bridges the gap between rigid CI/CD rules and nuanced, context-aware policy enforcement. The AI agents provide human-like reasoning capabilities while maintaining the reliability and scalability required for enterprise environments. The codebase is designed for extensibility, allowing teams to customize rule evaluation logic, add new event processors, and integrate with additional AI providers. The Kubernetes deployment strategy ensures high availability and easy scaling in production environments. Breaking Changes: - All configuration now uses environment variables - GitHub App setup required for webhook processing - AI provider configuration mandatory for rule evaluation Signed-off-by: Dimitris Kargatzis <dkargatzis@gmail.com>
1 parent 6bf52e0 commit 4f76571

95 files changed

Lines changed: 9829 additions & 31 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.env.example‎

Lines changed: 27 additions & 0 deletions

‎.github/workflows/eks-deploy.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
name: 'Deploy to EKS'
2+
on:
3+
push:
4+
branches:
5+
- 'main'
6+
release:
7+
types: [created]
8+
9+
jobs:
10+
deploy:
11+
name: Setup, Build, Publish, and Deploy
12+
runs-on: ubuntu-latest
13+
environment: preview
14+
env:
15+
EKS_CLUSTER: ${{ secrets.EKS_CLUSTER }}
16+
EKS_NAMESPACE: ${{ secrets.EKS_NAMESPACE }}
17+
AWS_REGION: ${{ secrets.AWS_REGION }}
18+
RELEASE_NAME: ${{ secrets.RELEASE_NAME }}
19+
PUBLIC_DOMAIN: ${{ secrets.PUBLIC_DOMAIN }}
20+
PORT: 8000
21+
HELM_PATH: helm-chart
22+
JOB_STATUS: succeeded
23+
24+
permissions:
25+
contents: 'read'
26+
id-token: 'write'
27+
packages: 'write'
28+
29+
steps:
30+
- name: Checkout
31+
uses: actions/checkout@v4
32+
33+
- name: Configure AWS credentials
34+
uses: aws-actions/configure-aws-credentials@v4
35+
with:
36+
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
37+
aws-region: ${{ env.AWS_REGION }}
38+
39+
- name: Login to Amazon ECR
40+
id: login-ecr
41+
uses: aws-actions/amazon-ecr-login@v2
42+
43+
- name: Build, tag, and push image to Amazon ECR
44+
id: ecr-push
45+
env:
46+
ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
47+
ECR_REPOSITORY: ${{ secrets.ECR_REPOSITORY }}
48+
IMAGE_TAG: ${{ github.sha }}
49+
run: |
50+
docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
51+
docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
52+
echo "image_repository=$ECR_REGISTRY/$ECR_REPOSITORY" >> $GITHUB_OUTPUT
53+
54+
- name: Update kubeconfig
55+
run: aws eks update-kubeconfig --region ${{ env.AWS_REGION }} --name ${{ env.EKS_CLUSTER }}
56+
57+
- name: Install or upgrade helm chart
58+
env:
59+
IMAGE_TAG: ${{ github.sha }}
60+
IMAGE_REPOSITORY: ${{ steps.ecr-push.outputs.image_repository }}
61+
run: |-
62+
helm upgrade ${{ env.RELEASE_NAME }} ${{ env.HELM_PATH }} --namespace ${{ env.EKS_NAMESPACE }} \
63+
--values ${{ env.HELM_PATH }}/values.yaml \
64+
--set image.repository=${{ env.IMAGE_REPOSITORY }} \
65+
--set image.tag=${{ env.IMAGE_TAG }} \
66+
--set secrets.APP_NAME_GITHUB=${{ secrets.APP_NAME_GITHUB }} \
67+
--set secrets.CLIENT_ID_GITHUB=${{ secrets.CLIENT_ID_GITHUB }} \
68+
--set secrets.APP_CLIENT_SECRET=${{ secrets.APP_CLIENT_SECRET }} \
69+
--set secrets.PRIVATE_KEY_BASE64_GITHUB=${{ secrets.PRIVATE_KEY_BASE64_GITHUB }} \
70+
--set secrets.GITHUB_WEBHOOK_SECRET=${{ secrets.GITHUB_WEBHOOK_SECRET }} \
71+
--set secrets.OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }} \
72+
--set secrets.LANGCHAIN_API_KEY=${{ secrets.LANGCHAIN_API_KEY }} \
73+
--set secrets.LANGCHAIN_PROJECT=${{ secrets.LANGCHAIN_PROJECT }} \
74+
--set ingress.hosts[0].host=${{ env.PUBLIC_DOMAIN }} \
75+
--set service.port=${{ env.PORT }} \
76+
--install
77+
78+
- name: Verify deployment
79+
run: |
80+
kubectl rollout status deployment/${{ env.RELEASE_NAME }} -n ${{ env.EKS_NAMESPACE }} --timeout=300s

‎.github/workflows/pre-commit-hooks.yaml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# Workflow name
2+
name: "Run pre-commit hooks"
3+
4+
# Trigger the workflow on pull requests and pushes to the "main" branch
5+
on:
6+
pull_request:
7+
branches:
8+
- "main"
9+
push:
10+
branches:
11+
- "main"
12+
13+
# Define the jobs for the workflow
14+
jobs:
15+
# Job name
16+
pre-commit:
17+
# Readable name for the job
18+
name: Lint code and README files
19+
# Runner environment for the job
20+
runs-on: ubuntu-latest
21+
22+
# Steps to be executed in the job
23+
steps:
24+
# Checkout the repository
25+
- name: Checkout
26+
uses: actions/checkout@v4
27+
with:
28+
fetch-depth: 0
29+
token: ${{ secrets.PAT_TOKEN }} # Use PAT for checkout to avoid permission issues
30+
31+
# Set up Python
32+
- name: Set up Python
33+
uses: actions/setup-python@v5
34+
with:
35+
python-version: '3.12'
36+
37+
# Set up a Python virtual environment
38+
- name: Set up Python and Virtual Environment
39+
run: |
40+
python3 -m venv venv # Create a virtual environment
41+
source venv/bin/activate # Activate the virtual environment
42+
pip install --upgrade pip # Upgrade pip to the latest version
43+
pip install pre-commit # Install pre-commit in the virtual environment
44+
45+
# Install pre-commit hooks
46+
- name: Install pre-commit hooks
47+
run: |
48+
source venv/bin/activate
49+
pre-commit install
50+
51+
# Run pre-commit hooks on all files
52+
- name: Run pre-commit
53+
id: precommit
54+
run: |
55+
source venv/bin/activate
56+
pre-commit run --all-files --show-diff-on-failure
57+
continue-on-error: true # Allow the job to continue even if pre-commit fails
58+
59+
# Commit and push changes if pre-commit fails
60+
- name: Commit and push changes
61+
if: steps.precommit.outcome == 'failure' # Only run this step if pre-commit fails
62+
run: |
63+
# Set Git user name and email for committing changes
64+
git config --global user.name "GitHub Actions"
65+
git config --global user.email "actions@github.com"
66+
67+
# Checkout the branch associated with the pull request
68+
git checkout ${{ github.head_ref }}
69+
70+
# Stage all changes
71+
git add .
72+
73+
# Check if there are any changes to commit
74+
if git diff --staged --quiet; then
75+
echo "No changes to commit"
76+
else
77+
# Commit the changes with a meaningful message
78+
git commit -m "chore: apply pre-commit hook fixes"
79+
80+
# Push the changes to the pull request branch using the PAT
81+
git push https://${{ secrets.PAT_TOKEN }}@github.com/${{ github.repository }} HEAD:${{ github.head_ref }}
82+
fi
83+
env:
84+
PAT_TOKEN: ${{ secrets.PAT_TOKEN }} # Set the PAT as an environment variable

‎.gitignore‎

Lines changed: 183 additions & 0 deletions

0 commit comments

Comments
 (0)