DevForge

Production-ready CI/CD pipelines, now with AI-powered recommendations.

For command details, see docs/COMMANDS.md.

AI Features

• ✦ Automatic LLM provider setup for Amazon Nova Pro, Gemini, OpenAI, Anthropic, and Bedrock.
• ✦ Recommendation Agent — runs on every init and flags pipeline issues.
• ✦ Security & Compliance Agent — NIST SP 800-53 + ISO 27001 scanning.
• ✦ Cross-session memory via Amazon Elastic.
• ✦ Full offline mode — AI is optional and the v1 engine always works.

Problem

• New projects spend too long recreating the same CI/CD setup by hand.
• Generic generators ignore the real project structure, so the first draft is rarely usable.
• Teams need deterministic output they can review, diff, and commit with confidence.

Quick Start

1. Run npx devforge init.
2. Choose your LLM provider or offline mode and confirm deployment options.
3. DevForge detects your framework, package manager, and deployment target.
4. Preview the generated workflows if you want a before/after diff.
5. Generate the files and commit them to your repository.

Features

| Feature | DevForge | Yeoman | Workik AI | Actions Importer | | --- | --- | --- | --- | --- | | Local project detection | Yes | Limited | No | No | | AI Recommendations | ✓ (DevForge) | — | ✓ (Workik) | — | | Compliance Scanning | ✓ | — | — | — | | Offline Mode | ✓ | ✓ | — | ✓ | | One command setup | Yes | Yes | Yes | No | | Deployment provider support | Yes | Via generators | Partial | Limited | | Docker generation | Yes | Via generators | Yes | No | | Secret guidance | Yes | No | Partial | No | | Dry run mode | Yes | Depends | Partial | No | | Update command | Yes | No | No | No | | Audit mode | Yes | No | No | No | | IaC detection (Terraform, CDK, boto3, Pulumi, Ansible) | Yes | No | No | No | | Automated deployment via detected IaC | Yes | No | No | No | | LLM-assisted IaC generation with verification loop | Yes | No | Partial | No |

Supported Frameworks

Supported Deployment Targets

| Target | IaC automation | Supported tools | |--------|---------------|----------------| | Vercel | Not needed (managed) | — | | Railway | Not needed (managed) | — | | Render | Not needed (managed) | — | | Firebase | Not needed (managed) | — | | AWS ECS (Fargate) | ✓ generate + execute | Terraform, CDK, boto3 | | AWS EKS | ✓ generate + execute | Terraform | | AWS EC2 | ✓ generate + execute | Terraform, boto3 | | Docker | ✓ generate + execute | Terraform |

Supported CI

• GitHub Actions
• Jenkins
• GitLab CI
• CircleCI

Commands

init is the primary entry point. It detects the project, collects deployment preferences, optionally previews the output, and writes the generated workflows plus secrets guidance into .devforge/.

update refreshes existing DevForge-managed workflows against the latest templates. It shows a diff, preserves custom sections, and only applies changes after confirmation.

deploy automates step-by-step AWS deployments (ECS, EKS, EC2) from the generated guide/plan with interactive prompts, live terminal output streaming, and reverse-order rollback capability.

audit scans any GitHub Actions workflow set for security, performance, and best-practice issues. It prints a per-file report and exits non-zero when high-severity findings exist.

preview renders the planned output in memory so you can inspect the exact YAML before anything is written to disk.

IaC Automation

DevForge detects existing IaC and, when none is present, can generate it:

• ✦ IaC detection (Terraform, CDK, boto3, Pulumi, Ansible)
• ✦ Automated deployment via detected IaC (with human-in-the-loop confirmation)
• ✦ LLM-assisted IaC generation — files assembled from verified building-block templates
• ✦ Verification loop: terraform validate, cdk synth, python -m py_compile before writing any file
• ✦ Retry loop: up to DEVFORGE_IAC_MAX_RETRY attempts (default 2), with error context fed back to the LLM
• ✦ Trivy IaC misconfiguration scanning on generated configs

See docs/IAC.md for full details.

Security

DevForge is designed to stay deterministic and reviewable:

• No remote model calls are required for generation.
• Templates are static and rendered through a strict variable allowlist.
• File writes use guarded paths and atomic operations.
• Secrets are reported as guidance, not injected into source files.
• The published package is hardened for release with a strict file allowlist and prepublish checks.

Docs

See docs/COMMANDS.md for the full command reference, docs/AGENT.md for the agent model, docs/SECURITY_COMPLIANCE.md for compliance scanning, and docs/IAC.md for IaC detection, generation, and verification.

Contributing

See CONTRIBUTING.md.

License

Licensed under the MIT License. See LICENSE.