Professional Documentation
Complete guide to @waiyat/devops v3 — preflight diagnostics, auto-repair, CI/CD scaffolding, and enterprise reusable workflows.
Getting Started
`@waiyat/devops` is a zero-config CLI and TypeScript library for preflight diagnostics, automated CI/CD workflow scaffolding, and enterprise reusable GitHub Actions quality gates. No installation required — run directly with npx.
Preflight Diagnostics
Scan your repository for CI/CD readiness, security gaps, Docker misconfigurations, and environment issues.
Auto-Repair Engine
Automatically heal .dockerignore, .gitignore, CI workflows, and non-root Docker USER directives.
Reusable Workflows
Inject enterprise GitHub Actions pipelines maintained centrally in Waiyat/devops.
Installation
Choose how you want to use @waiyat/devops in your project. Both options require zero configuration.
Run directly without installation. Always use @latest to ensure you get v3.0.0.
npx @waiyat/devops@latest checkInstall as a devDependency for programmatic API access or CI pipeline integration.
npm install --save-dev @waiyat/devops@latest
# or
pnpm add -D @waiyat/devops@latest
# or
yarn add -D @waiyat/devops@latestConfirm the CLI is available and running v3.0.0:
npx @waiyat/devops@latest --version\n# Expected output: 3.0.0System Requirements
- Node.js: v18.0.0 or later (Node 20+ LTS recommended)
- OS: macOS, Linux (Ubuntu, Debian, Alpine), Windows (WSL2 / PowerShell)
- Package Managers: npm, pnpm, yarn, bun supported
Architecture & Pipeline
@waiyat/devops processes repositories through a deterministic 5-stage pipeline architecture:
Detector
Identifies languages (TypeScript, Python, Go, Rust, Java), frameworks (Next.js, FastAPI, Django), and package managers (npm, pnpm, yarn, bun).
Project IR
Constructs a normalized Intermediate Representation of dependencies, scripts, and configuration files.
Diagnostics
Probes Quality & Runtime, CI/CD, DevSecOps, Docker, Environment, and Observability.
Scoring Layer
Computes weighted 0-100 category and overall health scores with per-check pass/fail/warn breakdowns.
Scaffolding & Auto-Fix
Injects reusable enterprise quality gates and heals safe misconfigurations automatically.
Data Flow
Repository Root
│
▼
┌────────────┐
│ Detector │ ───► Stack detection & language identification
└─────┬──────┘
▼
┌────────────┐
│ Project IR │ ───► Normalized domain model
└─────┬──────┘
▼
┌────────────┐
│Diagnostics │ ───► 6-category preflight checks
└─────┬──────┘
▼
┌────────────┐
│ Scoring │ ───► Weighted 0-100 health score
└─────┬──────┘
▼
┌────────────┐
│ Auto-Fixer │ ───► Self-healing remediation
└────────────┘CLI Command Reference
All official commands provided by @waiyat/devops v3. Organized by category for quick reference.
Core Commands
check
Run preflight diagnostics across 6 categories and calculate a weighted 0-100 health score.
npx @waiyat/devops@latest check --verbosefix
Auto-repair misconfigurations: CI workflows, .dockerignore, .gitignore, non-root Docker USER.
npx @waiyat/devops@latest fix --dry-rundoctor
Interactive diagnostic inspection with guided step-by-step auto-remediation.
npx @waiyat/devops@latest doctor --yesWorkflow Commands
init
Scaffold tailor-made CI/CD pipelines from templates (nextjs, node, docker, monorepo, full, pro).
npx @waiyat/devops@latest init --template pro --forcevalidate
Validate GitHub Actions workflow YAML syntax before pushing.
npx @waiyat/devops@latest validatelist
Browse modular reusable workflow recipes.
npx @waiyat/devops@latest listadd
Scaffold a specific modular recipe (e.g., security/dependency-scan).
npx @waiyat/devops@latest add security/dependency-scanSecurity & Governance
DevSecOps auditing, secret scanning, vulnerability detection, and policy compliance.
Deep-dive DevSecOps audit covering secret leak detection, permission checks, and security configuration validation.
npx @waiyat/devops@latest securityFail-on-vulnerabilities dependency audit across package ecosystems (npm, pnpm, yarn, bun).
npx @waiyat/devops@latest auditScan the repository for committed secrets, API tokens, and credential leaks before they reach production.
npx @waiyat/devops@latest secretsEvaluate repository policy compliance including branch protection, licensing, and hygiene rules.
npx @waiyat/devops@latest policyContainers & Maintenance
Dockerfile auditing, SBOM generation, artifact cleanup, and release engineering.
Generate CycloneDX v1.5 JSON software bill of materials with purl identifiers for supply chain transparency.
npx @waiyat/devops@latest sbom --jsonAudit Dockerfiles for non-root users, multi-stage builds, healthchecks, and layer caching.
npx @waiyat/devops@latest docker checkRemove generated artifacts (.next, dist, coverage) and stale dependency caches to reclaim disk space.
npx @waiyat/devops@latest clean --dry-runSemantic versioning bumps, conventional changelog generation, and git release tag automation.
npx @waiyat/devops@latest release --dry-runValidate environment variable parity between .env and .env.example files.
npx @waiyat/devops@latest envProgrammatic TypeScript / Node.js API
Import and execute @waiyat/devops core functions directly inside Node.js scripts or custom CI tooling.
import {
detectProject,
runDiagnostics,
runScoring,
runAutoFix,
generateSBOM,
} from "@waiyat/devops";
// 1. Detect project metadata & stack
const project = detectProject(process.cwd());
console.log(
`Stack: ${project.languages.join(", ")} | Frameworks: ${project.frameworks.join(", ")}`
);
// 2. Run diagnostics across all categories
const report = runDiagnostics(process.cwd(), project);
console.log(`Preflight Score: ${report.score}/100 [Ready: ${report.overallReady}]`);
console.log(
`Summary: ${report.passedCount} passed, ${report.warnCount} warnings, ${report.errorCount} errors`
);
// 3. Compute weighted health score via Scoring layer
const score = runScoring(process.cwd(), project);
console.log(
`Weighted Score: ${score.overall}/100 | Categories: ${JSON.stringify(score.categories)}`
);
// 4. Generate CycloneDX v1.5 SBOM
const sbom = generateSBOM(process.cwd(), project);
console.log(`Indexed ${sbom.components.length} packages in CycloneDX v1.5`);
// 5. Auto-heal repository issues
const fixResult = runAutoFix({ dryRun: true, rootDir: process.cwd() });
console.log(`Actions to apply: ${fixResult.actions.length}`);Type Definitions
interface Project {
languages: string[];
frameworks: string[];
packageManager: "npm" | "pnpm" | "yarn" | "bun";
hasDockerfile: boolean;
hasCI: boolean;
}
interface DiagnosticReport {
score: number;
overallReady: boolean;
passedCount: number;
warnCount: number;
errorCount: number;
categories: Record<string, { score: number; checks: CheckResult[] }>;
}
interface CheckResult {
name: string;
status: "pass" | "warn" | "fail";
message: string;
remediation?: string;
}
interface ScoringResult {
overall: number;
categories: Record<string, number>;
}
interface SBOM {
components: Array<{
name: string;
version: string;
purl: string;
}>;
}
interface FixResult {
actions: Array<{
category: string;
file: string;
action: string;
}>;
}Reusable GitHub Actions Workflows
Reference centralized, production-grade workflows maintained in Waiyat/devops directly from your repository.
name: CI Quality Gate
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
ci:
uses: Waiyat/devops/.github/workflows/reusable-ci.yml@main
with:
node-version: '22'
package-manager: 'pnpm'
run-build: true
run-test: true
run-audit: true
security:
needs: [ci]
uses: Waiyat/devops/.github/workflows/reusable-security.yml@mainAvailable Reusable Workflows
- ✓
reusable-ci.yml— Multi-runtime quality gate (lint, test, build, audit, coverage) - ✓
reusable-cd-docker.yml— Multi-arch Docker buildx & GHCR/DockerHub publishing - ✓
reusable-security.yml— Aqua Trivy SAST scanner & GitLeaks secret detector - ✓
reusable-release.yml— Semantic release & changelog generator
Diagnostics & Health Scoring
Six diagnostic categories with weighted scoring for comprehensive repository health assessment.
Quality & Runtime
Comprehensive checks for quality & runtime readiness and compliance.
CI/CD Automation
Comprehensive checks for ci/cd automation readiness and compliance.
DevSecOps & Secrets
Comprehensive checks for devsecops & secrets readiness and compliance.
Containers & Docker
Comprehensive checks for containers & docker readiness and compliance.
Environment
Comprehensive checks for environment readiness and compliance.
Observability
Comprehensive checks for observability readiness and compliance.
Score Interpretation
npx @waiyat/devops@latest fixTroubleshooting & FAQ
Common questions and solutions for using @waiyat/devops.
How do I test a generated workflow without creating a commit?
Use the --dry-run flag: npx @waiyat/devops@latest init --template nextjs --dry-run to preview the YAML directly in your terminal.
How do I customize the generated workflow?
The CLI detects the active package manager and runtime from your repository. Choose a workflow shape with --template, and use --output to change the target path: npx @waiyat/devops init --template node --output .github/workflows/quality.yml.
Why am I getting a cached v2.x binary with npx?
Always append @latest to force npx to fetch v3.0.0: npx @waiyat/devops@latest check.
What Node.js version is required?
Minimum Node.js v18.0.0 (v20+ LTS recommended) is required for v3.0.0.