View on GitHub · Documentation · Plugin Catalog · API Reference

Overview

Pipeline Builder is a self-hosted platform for standing up and running software factories on AWS. An organization gets a complete DevSecOps environment — secure delivery pipelines, supply-chain controls, compliance evidence, golden-path templates and the governance around them — in minutes rather than months, and can run many of them side by side.

The pipelines are one part of that environment, not the whole product. Every pipeline arrives with its controls already attached: signed and scanned plugins, SBOMs and vulnerability gates, per-organization secret encryption, policy-as-code compliance, and a tamper-evident audit trail. Developers reach it from the dashboard, the CLI, the REST API, a CDK construct, or a single AI prompt; platform and security teams set the rules that every one of those paths obeys.

Every pipeline is synthesized as native AWS CodePipeline + CodeBuild in your own AWS account. There is no proprietary runner and no lock-in: if you remove Pipeline Builder, your pipelines keep running.

It is multi-tenant from the ground up, which is what makes running many factories practical rather than theoretical. Every pipeline, plugin, secret, quota, log line, and bill belongs to an organization, and organizations can nest teams, bring their own SSO, and see each other only through deliberate, audited sharing.

Highlights

• You stand up a factory, not a pipeline. A new organization gets delivery pipelines, supply-chain controls, compliance rules, golden-path templates, identity and an audit trail on day one — not an empty CI server to assemble.
• Security is enforced, not advised. Non-compliant pipelines and plugins are refused at creation with a 403, instead of appearing in a report afterwards. 18 policy operators, with curated SOC 2 / PCI / CIS rule libraries.
• A supply chain you can prove. Every build step is a signed, SBOM-attested, digest-pinned container image, built by rootless BuildKit. Nightly CVE rescans raise advisories against what you are already running.
• Untrusted contributions stay contained. Anonymous plugin submissions are off by default; when enabled, each one builds in isolation with no credentials and no network, and must pass fail-closed security gates plus two-person review before anyone can install it.
• Evidence an auditor will accept. The audit trail is hash-chained and tamper-evident, so you can demonstrate it has not been edited. Each organization’s logs are isolated, and delivery metrics use measured lead times rather than estimates.
• One installation, many teams. Organizations nest teams, bring their own SSO, and see each other only through deliberate, audited sharing. Quotas, secrets, billing and logs all stop at the organization boundary.
• Five ways in, one set of rules. The dashboard, AI prompt, CLI, REST API and CDK construct all pass through the same checks, quotas and audit trail — so the convenient path and the governed path are the same path.
• AI that proposes, never disposes. Generate a pipeline from a sentence or a Git URL across 5 providers and 14 models. The assistant reads and suggests; it cannot change anything on its own.
• Nothing to be locked into. Pipelines are native AWS CodePipeline and CodeBuild in your own account. Remove Pipeline Builder and they keep running.
• Runs where you need it to. A laptop, a single EC2 host, or EKS — including private, inside-AWS-only installs with no public surface. The same security model on every target.

At a Glance

119	5	14	18	4	4
Official plugins in 10 categories	interfaces to build pipelines	AI models across 5 providers	compliance operators	plugin trust tiers	deploy targets, from laptop to EKS

Who it is for

If you are…	What you have on day one
A platform team serving many product teams	One installation that gives every team its own isolated organization, quotas and golden paths — instead of a CI server per team to maintain
A security or compliance lead	Controls that refuse non-compliant work at creation, a supply chain you can verify, and a tamper-evident audit trail you can hand to an auditor
Running a regulated or government programme	A self-hosted software factory in your own AWS account, optionally with no public surface, where evidence is a by-product of normal work rather than a quarterly scramble
Replacing a SaaS CI/CD contract	Native AWS pipelines that keep running if you remove the platform — you pay AWS for what executes, not a vendor for build minutes

Why Pipeline Builder

Challenge	How Pipeline Builder solves it
Standing up a secure delivery environment takes months	A working software factory — pipelines, controls, compliance, identity and audit — in minutes, from a dashboard, CLI, API, CDK, or AI prompt
Security review happens after the build is written	Compliance rules block non-compliant pipelines and plugins at creation, with exemptions and a full audit trail
Build steps are copy-pasted between teams	Versioned, containerized plugins shared through a governed ecosystem with installs, version policies, and reviews
Third-party build steps are a supply-chain risk	Signed, SBOM-attested, digest-pinned images; trust tiers baked into signatures; two-person approval for every public listing
Teams share infrastructure without isolation	Everything is scoped per organization, with RBAC, quotas, per-org secrets, per-org log tenants, and row-level security
Proving compliance means assembling evidence by hand	A hash-chained, tamper-evident audit trail, per-org log isolation, and measured delivery metrics — collected as work happens
SaaS CI/CD creates lock-in	Pipelines deploy as native AWS resources in your account and keep running without the platform
No visibility into delivery health	EventBridge-fed analytics, DORA metrics, maturity scorecards, and plugin health scores

---

Capabilities

Build pipelines five ways

Interface	Best for	What you do
Dashboard	Application developers	Configure sources and stages visually, then deploy
AI prompt	New repositories	Paste a Git URL; the repo is analyzed and stages and plugins are generated for you
CLI	Scripting and CI	pipeline-manager pipeline create from any shell
REST API	Platform automation	Full CRUD plus AI generation endpoints
CDK construct	Infrastructure-as-code teams	Deploy the PipelineBuilder construct from any CDK app

Golden-path templates. Platform teams publish governed starters with declared inputs. A developer picks one, sets the project and target repository, and gets a pipeline that still passes compliance and quota checks. Templates can be saved from an existing pipeline, authored from scratch, or imported.

Synth-time templating. A small {{ .. }} language for pipeline configs and plugin specs is resolved once, at synthesis, with no runtime evaluation and no shell-out. It supports path lookups, | default: fallbacks, type coercion, self-references with cycle detection, and plugin contracts (requiredMetadata, metadataTypes) that are validated at upload. See Template Syntax.

AI that proposes, you decide

Provider	Models
Anthropic	Claude Sonnet 5, Claude Opus 5, Claude Haiku 4.5
OpenAI	GPT-5.6 Sol, GPT-5.6 Terra, GPT-5.6 Luna
Google	Gemini 3.7 Flash, Gemini 3.1 Pro
xAI	Grok 4.6, Grok 4.5, Grok 4.3
Amazon Bedrock	Claude Sonnet 4.5, Amazon Nova Pro, Amazon Nova Lite

• Pipeline generation from a Git URL or natural language. It draws on the plugins your org can actually use and prefers your own, Official, and Verified plugins.
• Plugin generation writes a Dockerfile and spec checked against the same lint rules the catalog enforces.
• Ask, an in-app assistant grounded in the docs and your org’s data. Its tools can only read or propose. Anything it drafts is created only when you confirm, through your own session.

Plugin ecosystem

A plugin runs inside CodeBuild with your pipeline’s secrets and IAM role, so a shared plugin is a supply-chain dependency. The ecosystem treats it as one. Every public plugin is built by the platform, gated, approved by two people, signed with its trust tier, pinned by digest, and watched for new CVEs after it ships.

flowchart LR
  O["Org publisher"] --> T["Tenant build<br/>rootless · SBOM · signed"]
  A["Anonymous submitter<br/>verified email · proof of work"] --> Q["Quarantine<br/>isolated build · no credentials"]
  T --> G["Automated gates<br/>lint · license · CVE · contract"]
  Q --> H["Stricter gates<br/>+ heuristics · offline smoke test · look-alike names"]
  G --> M{"Two-person<br/>approval"}
  H --> M
  M -->|approve| P["public/&lt;publisher&gt;/&lt;name&gt;<br/>re-signed · immutable"]
  P --> I["Org installs<br/>version + trust policy"]
  I --> R["Pipeline pulls<br/>by digest"]
  S["Nightly CVE rescan"] -.->|advisory · yank| I

Discover

• Public directory: /plugins has full-text search, facets, category pages, and a page per plugin with README, versions, SBOM, advisories, reviews, and health. Anyone can browse it without signing in, and sign-in is always one click away.
• 119 Official plugins in 10 categories (table below), maintained under the pipeline-builder publisher and available to every org by default.

Trust tiers and governance

• Four tiers: Official, Verified (Team+ publishers with a verified domain and MFA), Community (any signed-in org), and Unverified (anonymous submissions).
• Tier in the signature. The tier and publisher are baked into each image’s cosign signature and checked on every lookup. A mismatch fails the step (409 IMAGE_VERIFICATION_FAILED).
• Only the system org approves. Every new listing and version needs two-person approval with no self-dealing, from a dedicated system-org-only Ecosystem Manager role at MFA-level assurance. Tenants submit requests; they can’t publish directly.
• Auto-approval, where configured, applies only to narrow, gate-green updates such as Official patch and minor releases. It is capped and audited.

Plugin quarantine for anonymous submissions (optional, off by default)

• Identity-light, not identity-free. A submission needs a verified email via a single-use magic link and a self-hosted proof-of-work challenge (no third-party captcha, so it works air-gapped). Each email and IP gets at most 3 submissions a day. The email is stored only hashed and encrypted, is never displayed, and is purged 90 days after the decision.
• Quarantine storage. The zip lands in a dedicated plugin-quarantine bucket with 30-day expiry. The image goes to a quarantine/<id> registry namespace that only the plugin service can reach: no tenant, and not even a super admin, can list or pull it.
• Isolated build pool. Submissions are built on a separate BuildKit that is never the tenant builder. It has no credentials, no service-account token, and no cloud identity. On EKS it runs on its own tainted node pool. Egress is limited to package mirrors and the registry, and the mesh blocks it from reaching every other service.
• Fail-closed gates: spec and contract validation, SPDX license, Dockerfile lint, a non-root image, a grype vulnerability threshold, and heuristics that look for crypto miners, obfuscated payloads, cloud-credential and metadata-endpoint access, pipe-to-shell installs, and secret-looking defaults. A smoke test then runs with no network.
• Name protection: reserved names and confusable look-alikes of popular plugins are refused.
• Human moderation. Moderators see the gate report, every heuristic finding, the SBOM, and a diff against the previous version. Approved submissions are listed as community/<name> at the Unverified tier. The submitter can later claim the listing by creating an account with the same email.

Supply chain

• Rootless BuildKit runs with no Docker daemon and no socket mount, and every image runs as non-root.
• Every image carries an SPDX SBOM and SLSA provenance.
• Upload hardening rejects zip bombs, path traversal, and symlink entries.
• Pinned at request time. A request pins the digest, so the image that ships is the one that was reviewed.
• On approval, the image is copied into a read-only public/* namespace and re-signed fresh. Listed versions are immutable, and pipelines pull by digest on every run.

Consume on your terms

• Orgs install listings with semver version policies, choose which trust tiers they allow, block specific listings, and can require in-org approval for new installs. Teams inherit their parent’s installs.
• Pipelines reference plugins by publisher and version range. Resolution is predictable: your own org, then your parent org, then Official. A same-name shadow comes with a warning.

Respond fast

• A nightly CVE rescan drafts security advisories when a new critical or high vulnerability hits a listed version, and security fixes get a faster review lane.
• Published advisories notify every installing org, and pipelines warn or block per org policy.
• Moderators can yank versions or suspend listings instantly. Publishers can pause or deprecate their own.

Quality signals

• Reviews and ratings from signed-in users, with a verified-use badge drawn from real runs, moderation, and publisher replies.
• Health score from 0 to 100, built from runtime success rate, vulnerabilities, freshness (including base-image age), signing, smoke test, docs, and rating. It is shown in the directory and used to rank AI suggestions.
• Publisher Insights: installs, k-anonymous active-org counts, success rate, rating trend, and open reports and advisories.

Author with confidence

• pipeline-manager plugin new | validate | test | publish scaffolds from base images and runs the server’s own lint, template-contract, and heuristic checks locally.
• Catalog metadata is detected from the package (spec, README, Dockerfile labels), and you accept or edit each field.
• AI plugin generation flags similar existing plugins to curb duplicates.

Category	Count	Examples
Language	11	Java, Python, Node.js, Go, Rust, .NET, C++, PHP, Ruby
Security	34	Snyk, SonarCloud, Trivy, Veracode, Semgrep, Checkmarx, Fortify
Quality	17	ESLint, Prettier, Checkstyle, Clippy, Ruff, ShellCheck
Testing	14	Jest, Pytest, Cypress, Playwright, k6, Postman, Artillery
Artifact & Registry	16	Docker, ECR, GHCR, npm, PyPI, Maven, NuGet, Cargo
Deploy	13	Terraform, CloudFormation, Kubernetes, Helm, Pulumi, ECS, Lambda, CDK
Infrastructure	5	CDK synth, manual approval, S3 cache, shell
Monitoring	3	Datadog, New Relic, Sentry
Notification	5	Slack, Teams, PagerDuty, email, GitHub status
AI	1	Dockerfile generation (multi-provider)

See Installing Plugins, Publishing Plugins, and the Plugin Catalog.

Policy-as-code compliance

Validate plugins and pipelines before they exist, not in a quarterly audit.

• 18 operators: equality, comparison, contains, set membership, regex, presence, not-empty, count, and length. Computed fields ($count, $length, $keys, $lines) and cross-field conditions are also available.
• Three severities: warning is advisory; error and critical block creation with HTTP 403.
• Rule catalog and inheritance. The system org publishes recommended rules that orgs subscribe to rule by rule. Parent orgs push rules down to their teams.
• Curated add-ons: Standard covers CI/CD best practices, Advanced covers SOC 2 / PCI / CIS, and the Suite bundles both. Authoring your own rules stays free.
• Exemptions, bulk and scheduled scans, and evidence for audits, plus notifications through the in-app inbox, email, or an HMAC-signed webhook, sent immediately or as digests.

See Compliance.

Organizations, access, and identity

• Organizations and teams. An organization is the isolation boundary. Teams nest one level under a parent, which is opt-in. Parents administer their teams, and visibility, compliance, pooled quotas, and analytics roll across the hierarchy.
• RBAC. Roles are sets of fine-grained resource:action permissions. Built-in Admin and Member roles can be extended with custom roles. Reads and writes are both enforced, and privilege changes revoke live sessions.
• Sign-in. Email and password (with a breached-password check and org password policies), six social providers, and per-org SSO over OIDC or SAML 2.0. SSO supports just-in-time membership, IdP group → role mapping, and SCIM 2.0 provisioning.
• Strong authentication. Passkeys (WebAuthn) and TOTP, with assurance levels that sensitive admin actions require. Resetting a lost MFA factor needs two people. Impersonation for support requires the user’s consent.
• Machine access. Personal access keys limited to a subset of your permissions, service accounts, per-service internal keys, ES256-signed tokens published over JWKS, and CLI sign-in by device authorization.
• Plans and billing. Four tiers (Developer, Pro, Team, Enterprise) with seat and resource quotas, stackable add-on bundles, coupons and usage credits, and Stripe or AWS Marketplace billing. With billing disabled, everything is unlimited.
• Isolated secrets. Each org’s secrets live under its own AWS Secrets Manager path. They are injected at build time and never baked into images.

See Roles & Permissions and Authentication & SSO.

Observe and improve

• Execution analytics. CodePipeline and CodeBuild events flow through EventBridge and give success rates, p50/p90/p99 durations, stage failure heatmaps, error categories, and per-org cost attribution. The ingestion Lambda runs in your account and never forwards your AWS account number or pipeline ARNs.
• DORA metrics. Deployment frequency, change failure rate, MTTR fed by an incident webhook for PagerDuty, Datadog, or Alertmanager, and measured commit-to-deploy lead time, with performance bands and trends.
• Developer portal. Catalog ownership, a My Services view, and a per-pipeline maturity scorecard that grades compliance posture and DORA from A to F.
• Per-org logs. A Loki-backed log explorer in which each org is its own tenant, with masking at ingest and permission-gated export.
• Tamper-evident audit. Every privileged action goes into a per-tenant hash chain that you can check with /audit/verify. A durable spool keeps the security log intact through outages.

Built for production

• Zero-trust internals. Service-to-service calls use short-lived signed tokens and the same auth middleware as user requests. Underneath, an Istio ambient mesh enforces STRICT mTLS and identity-based authorization on every target.
• Data safety. Postgres enforces row-level security per tenant. Soft-deleted pipelines and plugins can be restored within a retention window, and backups are documented with RPO/RTO targets.
• Operable. Every service exposes /health, /ready, /warmup, and /metrics. The platform ships with Prometheus, Thanos, Grafana dashboards, Alertmanager rules, Jaeger tracing, and Kiali.
• Redis high availability with Sentinel on the AWS targets, and graceful degradation when a dependency is down.

---

Architecture

flowchart TB
    subgraph Interfaces
        DASH["Dashboard"] & CLI["CLI"] & API["REST API"] & CDK["CDK Construct"] & DIR["Public Plugin Directory"]
    end

    subgraph Platform["Platform Service"]
        AUTH["Identity · Orgs · RBAC · Audit"]
    end

    subgraph Backend["Backend Services"]
        PIPELINE["Pipeline"] & PLUGIN["Plugin + Ecosystem"]
        COMPLIANCE["Compliance"]
        REPORTING["Reporting"]
        REGISTRY["Image Registry"]
        ASK["Ask (AI)"]
        SUPPORT["Quota · Billing · Messages"]
    end

    CORE["pipeline-core<br/>CDK Synth"]
    AWS["Your AWS Account"]

    DASH & CLI & API -->|token| Platform
    DIR --> PLUGIN
    CDK --> CORE
    Platform --> PIPELINE & PLUGIN & COMPLIANCE & REPORTING & ASK & SUPPORT
    PLUGIN & PIPELINE -->|validate| COMPLIANCE
    PLUGIN -->|build · sign · publish| REGISTRY
    PIPELINE --> CORE
    CORE --> AWS
    AWS -->|pull by digest| REGISTRY
    AWS -->|EventBridge| REPORTING

    style Platform fill:#4A90D9,color:#fff
    style CORE fill:#F5A623,color:#fff
    style AWS fill:#2ECC71,color:#fff
    style COMPLIANCE fill:#E74C3C,color:#fff
    style REPORTING fill:#9B59B6,color:#fff

Service	Purpose
Platform	Identity (passwords, OAuth, SSO, passkeys, TOTP, SCIM), organizations and teams, RBAC, audit trail, log access
Pipeline	Pipeline CRUD, AI generation, templates, CDK synthesis
Plugin	Plugin builds (rootless BuildKit), the plugin ecosystem (publishers, listings, installs, reviews, advisories, public directory), AI plugin generation
Image Registry	Plugin images with token auth, signing and SBOM attestation, per-org storage quotas, garbage collection
Compliance	Per-org rule enforcement, rule catalog and subscriptions, scans, exemptions
Reporting	Execution analytics, DORA metrics, incidents, via EventBridge
Ask	Grounded in-app AI assistant (read and propose only)
Quota / Billing / Message	Resource limits pooled across teams, subscriptions and bundles, announcements, conversations, and attachments

For end-to-end flows (plugin build, publish, pipeline create, synth, execution), see Architecture Flow. For the business case, see Organization Benefits.

---

Quick Start

Recommended: install with the CLI. pipeline-manager infra provision picks the target and checks prerequisites. It can fetch missing single-binary tools (yq, kubectl, minikube), generate the local .env with secrets, and build the exact, validated command to run. With an AI key set, it can also parse a natural-language goal and diagnose failures.

npm install -g @pipeline-builder/pipeline-manager
pipeline-manager infra provision --target docker              # show the plan, then ask to confirm
pipeline-manager infra provision --target docker --yes        # non-interactive (for CI)
pipeline-manager infra provision --target docker --json       # print the plan as JSON, run nothing
# or describe the goal: pipeline-manager infra provision --prompt "deploy to EKS in us-east-1 with email"

--init <mode> controls post-deploy initialization. The default, auto, has the deploy initialize the platform itself: on EC2 at first boot, on EKS in setup.sh’s final phase, and on local/minikube through infra provision. Use --init manual to run init-platform yourself (for example, to set real admin credentials) or --init skip to do nothing. See the AWS deployment guide.

Prefer to run it directly? Every target ships a bin/setup.sh:

git clone https://github.com/mwashburn160/pipeline-builder.git && cd pipeline-builder

(cd deploy/local/docker && ./bin/setup.sh)     # 1. pull images and start the stack
./deploy/bin/init-platform.sh docker           # 2. register the admin and load plugins

Minikube instead of Docker? Run (cd deploy/local/minikube && ./bin/setup.sh), then ./deploy/bin/init-platform.sh minikube. On an ~8-core laptop use LEAN=1, because the full stack plus the Istio mesh won’t fit in 8 vCPU. LEAN drops the optional observability and admin services and runs single replicas. For more disk, use DISK_SIZE=60g (default 30g; applies only when the cluster is created). For a clean restart, run minikube delete --profile=pipeline-builder.

Then open https://localhost:8443 and sign in as the default local admin, admin@internal / Pipeline-Builder-Dev-2026!. Change this password immediately on any environment reachable beyond your laptop.

The first load uses a self-signed certificate. If the page is blank with ERR_CERT_AUTHORITY_INVALID errors for JS chunks, trust deploy/local/docker/certs/nginx-tls.crt (see Troubleshooting).

Prerequisites: Docker only. The local stack pulls prebuilt public images, so no registry login is needed. Node.js >= 24.21 and pnpm >= 10.33 are needed only to build from source or use the CLI.

---

Deployment Options

Target	Best for	Cost
Local (Docker Compose)	Development	Free
Minikube	Local Kubernetes	Free
EC2	Dev / staging	~$610–680/mo at the default size (detail)
EKS (Auto Mode)	Production	~$850–950/mo running 24/7 (measured)

---

Development

Building from source (not needed just to run the platform):

pnpm install          # Node.js >= 24.21, pnpm >= 10.33
pnpm build            # compile, test, and lint every package

Path	Contains
packages/	Shared libraries: api-core, api-server, ai-core, pipeline-data, pipeline-core, pipeline-events, pipeline-manager (the CLI)
api/	Backend services: pipeline, plugin, image-registry, compliance, reporting, ask, quota, billing, message
platform/	Identity, organizations, users, audit, and the observability proxy
frontend/	Next.js dashboard and public plugin directory
deploy/	Per-target install (local/docker, local/minikube, aws/ec2, aws/eks) and the plugin catalog (deploy/plugins)
docs/	Documentation

This repo is projen-managed. package.json, tsconfig.json, and the CI workflows are generated. Edit .projenrc.ts / projenrc/ and re-run pnpm dlx projen, or your change is overwritten on the next synth.

---

Documentation

The full docs hub is docs/, grouped by task. For a term, see the Content Index (A–Z).

Start here

Document	Description
Onboarding a New Organization	First admin: login → org → members → access key → store-token → setup-events → first pipeline
Pipeline Manager CLI	Provision the platform, build and deploy pipelines, author plugins, run audits
AWS Deployment	Deploy to EC2 or EKS: modes, post-deploy setup, reporting, teardown

Build

Document	Description
Developer Guide	Five ways to create a pipeline, plus cut-and-paste patterns for 7 languages
CDK Usage	PipelineBuilder construct: sources, stages, VPC, IAM, secrets
Template Syntax	{{ .. }} synth-time interpolation and golden-path templates
Metadata Keys	Typed CodePipeline, CodeBuild, networking, and IAM configuration keys
Plugin Catalog	119 Official plugins across 10 categories
Installing Plugins	Trust tiers, installs, version policies, consumption policy, reviews
Publishing Plugins	Publisher profiles, publish requests, catalog metadata, pausing
Developer Portal	Catalog ownership, My Services, golden-path templates, maturity scorecards
Samples	Ready-to-load pipeline templates for 7 languages, plus CDK patterns

Govern

Document	Description
Organization Benefits	What orgs gain from standardizing on the platform
Roles & Permissions	Permission catalog, built-in roles, assurance tiers, session invalidation, impersonation
Permission Contract	Hand-maintained route-to-permission table; a diff here is a permission change, reviewed as one
Compliance	Per-org rule engine: validation, enforcement, add-ons, audit trail
Authentication & SSO	Passwords, OAuth, OIDC and SAML SSO, SCIM, passkeys, TOTP, device sign-in
Audit Events	Hash-chained trail, /audit/verify, action catalog
Logs	Per-org application logs: search, masking, export
Billing Providers	Stripe and AWS Marketplace setup
Billing Add-on Bundles	Stackable add-ons that raise pooled caps and unlock features
Billing Discounts	Coupon codes and usage credits

Operate

Document	Description
Deploy Operations	Preflight, secret rotation, backups and DR, teardown
Service Mesh	Istio ambient: STRICT mTLS and identity-based authorization
Environment Variables	Every configuration variable, by subsystem
Notifications	Email, Slack, webhooks and the in-app inbox — what an operator enables, what an org configures
DORA Metrics	Deployment frequency, change failure rate, MTTR, measured lead time
Stakeholder Reports	Scheduled snapshot reports held for human review; authoring and sharing are separate permissions
Incident Webhook	Connect PagerDuty, Datadog, or Alertmanager for change failure rate and MTTR

Reference

Document	Description
API Reference	REST endpoints, query parameters, curl examples
Architecture Flow	End-to-end flow diagrams (request → build → deploy)
Error Handling	Error-to-HTTP convention
Testing Conventions	Module-mocking rules, authorization gates that run for real, coverage ratchet, type-checked tests

---

License

Apache License 2.0. See LICENSE.