devops-cli — Workstation DevOps CLI & Multi-Persona AI Code Reviewer

devops-cli is an enterprise-grade workstation CLI and agentic code analysis platform designed for Site Reliability Engineers and DevOps Practitioners running inside VS Code Dev Containers. It unifies multi-repository infrastructure management (Git, Kubernetes, Kustomize, ArgoCD, Grafana, Prometheus, Docker, SSH) with multi-persona Agentic LLM code reviews, OS Keyring secret isolation, active SSRF network guardrails, and automated release orchestration.

• Zero-Plaintext Secret Architecture: Sensitive tokens (grafana.token, argocd.token, ai.api_key) are stored exclusively in the OS Keyring via Python keyring. GitHub access is gh's own login: each process acts as the one identity gh auth token returns. Configuration files contain zero plaintext credentials.
• Active SSRF & Egress Guardrails: Outbound API requests pass through strict IP validation (validate_service_url) blocking private subnets (RFC 1918), loopbacks, and cloud metadata endpoints by default.
• Multi-Persona Agentic Code Review: Paginated diff analysis across branches and PRs using specialized expert personas (devsecops, architect, pm, auditor, qa) backed by ScratchpadBuffer reasoning context and deterministic finding verification.
• Native DevContainer Lifecycle Engine: Cross-platform Python lifecycle orchestration (devops devcontainer run-lifecycle) replaces legacy shell scripts for post-create and post-start hooks.
• End-to-End Release Cycle Automation: Native devops release subcommands suite (status, prepare, check, notes, tag) automating version bumping, changelogs, docs sync, and CI validation.
• FastMCP Server & Native Tool Bridge: Infrastructure and analysis tools exposed over Model Context Protocol for seamless integration into AI IDEs and autonomous subagents.

• System Architecture & Technical Design (ARCHITECTURE.md) — Subsystem topologies, multi-agent sequence diagrams, and lifecycle hooks.
• Release Cycle & Versioning Guide (RELEASE_CYCLE.md) — Semantic versioning, validation checks, and release procedures.
• Security Policy & Threat Model (SECURITY.md) — Vulnerability disclosure, SSRF protections, and OS Keyring encryption.
• Contributor Guidelines (CONTRIBUTING.md) — Standards, local development with uv, and PR workflows.
• Routine Tasks, Order & Methodology Guide (docs/ROUTINE_TASKS.md) — Operational task matrix, cadences, execution order, and troubleshooting protocols.
• Tool Cheatsheets & Command Translation (docs/cheatsheets/README.md) — Side-by-side comparison of standard DevOps tools (git, kubectl, helm, docker, terraform, trivy, prometheus, grafana, ollama) vs devops-cli.
• Consolidated CLI Reference (docs/CLI_REFERENCE.md) — Full subcommand reference.
• Environment Variables Guide (docs/ENV_VARS.md) — System and environment settings.
• FastMCP Tools Specification (docs/MCP_TOOLS.md) — Registered MCP tools.

# 1. Clone repository and open inside Dev Container
git clone https://github.com/dan-petty/devops-cli.git
cd devops-cli

# 2. Inside the Dev Container, sync Python 3.14 dependencies:
uv sync

# 3. Log in to GitHub with gh, and store other credentials in the OS Keyring
gh auth login
devops ai config --provider claude
devops config set ai.api_key "sk-ant-..."

# 4. Verify LLM connectivity and run CI validation
devops ai test
devops ci run

Every release automatically builds and publishes a pre-packaged Dev Container image to the GitHub Container Registry (GHCR):

# Pull the pre-built Dev Container image directly:
docker pull ghcr.io/dan-petty/devops-cli/devcontainer:latest

To use this pre-built image in any repository's .devcontainer/devcontainer.json:

{
  "name": "devops-workstation",
  "image": "ghcr.io/dan-petty/devops-cli/devcontainer:latest"
}

from pathlib import Path
from devops_cli.ai.client import LLMClient
from devops_cli.ai.review import ReviewPipelineOrchestrator

# Initialize unified LLM client and orchestrator
client = LLMClient()
orchestrator = ReviewPipelineOrchestrator(session_id="custom-session", llm_client=client)

# Execute 6-stage review pipeline programmatically
metadata = orchestrator.run_pre_analysis_refresh(Path.cwd())
payloads = orchestrator.init_per_file_payloads(["src/file.py"], metadata)
orchestrator.execute_multi_persona_review(
    payloads, diff_text_by_file={}, personas=["devsecops", "architect"]
)
orchestrator.execute_finding_verification(payloads)
orchestrator.execute_finding_reranking(payloads)
summary_data, report_md = orchestrator.generate_consolidated_report(payloads)

• DevSecOps (--persona devsecops): OWASP Top 10, secret leaks, supply chain vulnerabilities, Docker/IaC security misconfigurations.
• Architect (--persona architect): SOLID principles, clean architecture/DDD, microservice coupling, observability, API contract design.
• Project Manager (--persona pm): Scope risk, breaking changes, test coverage adequacy, deployment rollback readiness, action items.
• Auditor (--persona auditor): Regulatory compliance frameworks (NIST SP 800-53, PCI-DSS v4.0, SOC 2 Type II) with exact control IDs.
• QA / Test Engineer (--persona qa): Regression prevention, test coverage gaps, edge cases, pytest code skeletons, validation steps.

1. Local Workstation Timeouts: High timeouts (DEFAULT_HTTP_TIMEOUT_SECONDS = 3600.0 per LLM request, DEFAULT_REVIEW_TIMEOUT_SECONDS = 1200.0 per review request, unless ai.timeout or ai.tasks.<task>.timeout sets one; DEFAULT_SUBPROCESS_TIMEOUT_SECONDS = 1800.0) support local LLM inference (CPU/GPU Ollama) and corporate proxies.
2. Key Material Mounting: ${localEnv:HOME}/.ssh is bind-mounted by design into .devcontainer for local SSH key generation and 90-day rotation.
3. SSRF Protections: validate_service_url blocks non-public IPs unless DEVOPS_CLI_AI_ALLOW_PRIVATE_NETWORK=true is set. A service URL from the user's own configuration (Ollama, Qdrant, the LLM gateway, a provider's api_base_url) may also name loopback (validate_configured_service_url).
4. Workspace Boundary Guards: Path traversal checks (_is_safe_workspace_path) enforce repository boundaries on file commands.
5. Checksum Verification: devops install-tools validates SHA-256 checksums before writing binaries to disk.
6. Automated Design Justification & Documentation Maintenance: Non-instructional, reference-backed inline comments (# NOTE (Design Justification - <REF>): ...) automatically document intentional design trade-offs directly above target code constructs, and project documentation (AGENTS.md, README.md, CLAUDE.md, .github/copilot-instructions.md) is routinely updated whenever code or prompt conventions evolve.

The comprehensive Value vs. Effort Prioritization Matrix, phased milestone deliverables (v0.2.4 through v0.3.0), architectural principles, and continuous release schedules are actively managed in the dedicated Product Roadmap.

• AGENTS.md — Single source of truth for AI agents.
• Knowledge Base — Comprehensive technical manual for tools and operational tasks.
• RELEASE_NOTES.md — Version release notes and highlights.
• CHANGELOG.md — Historical release and version changes.
• ROADMAP.md — Vision, principles, and phased deliverables.
• KNOWN_ISSUES.md — Operational edge cases and intentional design trade-offs.

Distributed under the MIT License. See LICENSE for details.