Documentation v3.0

Professional Documentation

Complete guide to @waiyat/devops v3 — preflight diagnostics, auto-repair, CI/CD scaffolding, and enterprise reusable workflows.

npm version
3.0.0
license
MIT
node required
v18+
Section 1

Getting Started

`@waiyat/devops` is a zero-config CLI and TypeScript library for preflight diagnostics, automated CI/CD workflow scaffolding, and enterprise reusable GitHub Actions quality gates. No installation required — run directly with npx.

Preflight Diagnostics

Scan your repository for CI/CD readiness, security gaps, Docker misconfigurations, and environment issues.

Auto-Repair Engine

Automatically heal .dockerignore, .gitignore, CI workflows, and non-root Docker USER directives.

Reusable Workflows

Inject enterprise GitHub Actions pipelines maintained centrally in Waiyat/devops.

Section 2

Installation

Choose how you want to use @waiyat/devops in your project. Both options require zero configuration.

Option 1: npx (Recommended)

Run directly without installation. Always use @latest to ensure you get v3.0.0.

bash
npx @waiyat/devops@latest check
Option 2: devDependency

Install as a devDependency for programmatic API access or CI pipeline integration.

bash
npm install --save-dev @waiyat/devops@latest
# or
pnpm add -D @waiyat/devops@latest
# or
yarn add -D @waiyat/devops@latest
Verify Installation

Confirm the CLI is available and running v3.0.0:

bash
npx @waiyat/devops@latest --version\n# Expected output: 3.0.0

System Requirements

  • Node.js: v18.0.0 or later (Node 20+ LTS recommended)
  • OS: macOS, Linux (Ubuntu, Debian, Alpine), Windows (WSL2 / PowerShell)
  • Package Managers: npm, pnpm, yarn, bun supported
Section 3

Architecture & Pipeline

@waiyat/devops processes repositories through a deterministic 5-stage pipeline architecture:

1

Detector

Identifies languages (TypeScript, Python, Go, Rust, Java), frameworks (Next.js, FastAPI, Django), and package managers (npm, pnpm, yarn, bun).

2

Project IR

Constructs a normalized Intermediate Representation of dependencies, scripts, and configuration files.

3

Diagnostics

Probes Quality & Runtime, CI/CD, DevSecOps, Docker, Environment, and Observability.

4

Scoring Layer

Computes weighted 0-100 category and overall health scores with per-check pass/fail/warn breakdowns.

5

Scaffolding & Auto-Fix

Injects reusable enterprise quality gates and heals safe misconfigurations automatically.

Data Flow

Pipeline Flow
Repository Root
       │
       ▼
 ┌────────────┐
 │ Detector   │ ───► Stack detection & language identification
 └─────┬──────┘
       ▼
 ┌────────────┐
 │ Project IR │ ───► Normalized domain model
 └─────┬──────┘
       ▼
 ┌────────────┐
 │Diagnostics │ ───► 6-category preflight checks
 └─────┬──────┘
       ▼
 ┌────────────┐
 │  Scoring   │ ───► Weighted 0-100 health score
 └─────┬──────┘
       ▼
 ┌────────────┐
 │ Auto-Fixer │ ───► Self-healing remediation
 └────────────┘
Section 4

CLI Command Reference

All official commands provided by @waiyat/devops v3. Organized by category for quick reference.

Core Commands

check

Run preflight diagnostics across 6 categories and calculate a weighted 0-100 health score.

bash
npx @waiyat/devops@latest check --verbose

fix

Auto-repair misconfigurations: CI workflows, .dockerignore, .gitignore, non-root Docker USER.

bash
npx @waiyat/devops@latest fix --dry-run

doctor

Interactive diagnostic inspection with guided step-by-step auto-remediation.

bash
npx @waiyat/devops@latest doctor --yes

Workflow Commands

init

Scaffold tailor-made CI/CD pipelines from templates (nextjs, node, docker, monorepo, full, pro).

bash
npx @waiyat/devops@latest init --template pro --force

validate

Validate GitHub Actions workflow YAML syntax before pushing.

bash
npx @waiyat/devops@latest validate

list

Browse modular reusable workflow recipes.

bash
npx @waiyat/devops@latest list

add

Scaffold a specific modular recipe (e.g., security/dependency-scan).

bash
npx @waiyat/devops@latest add security/dependency-scan
Section 5

Security & Governance

DevSecOps auditing, secret scanning, vulnerability detection, and policy compliance.

security

Deep-dive DevSecOps audit covering secret leak detection, permission checks, and security configuration validation.

bash
npx @waiyat/devops@latest security
audit

Fail-on-vulnerabilities dependency audit across package ecosystems (npm, pnpm, yarn, bun).

bash
npx @waiyat/devops@latest audit
secrets

Scan the repository for committed secrets, API tokens, and credential leaks before they reach production.

bash
npx @waiyat/devops@latest secrets
policy

Evaluate repository policy compliance including branch protection, licensing, and hygiene rules.

bash
npx @waiyat/devops@latest policy
Section 6

Containers & Maintenance

Dockerfile auditing, SBOM generation, artifact cleanup, and release engineering.

sbom

Generate CycloneDX v1.5 JSON software bill of materials with purl identifiers for supply chain transparency.

bash
npx @waiyat/devops@latest sbom --json
docker check

Audit Dockerfiles for non-root users, multi-stage builds, healthchecks, and layer caching.

bash
npx @waiyat/devops@latest docker check
clean

Remove generated artifacts (.next, dist, coverage) and stale dependency caches to reclaim disk space.

bash
npx @waiyat/devops@latest clean --dry-run
release

Semantic versioning bumps, conventional changelog generation, and git release tag automation.

bash
npx @waiyat/devops@latest release --dry-run
env

Validate environment variable parity between .env and .env.example files.

bash
npx @waiyat/devops@latest env
Section 7

Programmatic TypeScript / Node.js API

Import and execute @waiyat/devops core functions directly inside Node.js scripts or custom CI tooling.

scripts/audit.ts
import {
  detectProject,
  runDiagnostics,
  runScoring,
  runAutoFix,
  generateSBOM,
} from "@waiyat/devops";

// 1. Detect project metadata & stack
const project = detectProject(process.cwd());
console.log(
  `Stack: ${project.languages.join(", ")} | Frameworks: ${project.frameworks.join(", ")}`
);

// 2. Run diagnostics across all categories
const report = runDiagnostics(process.cwd(), project);
console.log(`Preflight Score: ${report.score}/100 [Ready: ${report.overallReady}]`);
console.log(
  `Summary: ${report.passedCount} passed, ${report.warnCount} warnings, ${report.errorCount} errors`
);

// 3. Compute weighted health score via Scoring layer
const score = runScoring(process.cwd(), project);
console.log(
  `Weighted Score: ${score.overall}/100 | Categories: ${JSON.stringify(score.categories)}`
);

// 4. Generate CycloneDX v1.5 SBOM
const sbom = generateSBOM(process.cwd(), project);
console.log(`Indexed ${sbom.components.length} packages in CycloneDX v1.5`);

// 5. Auto-heal repository issues
const fixResult = runAutoFix({ dryRun: true, rootDir: process.cwd() });
console.log(`Actions to apply: ${fixResult.actions.length}`);

Type Definitions

types/index.d.ts
interface Project {
  languages: string[];
  frameworks: string[];
  packageManager: "npm" | "pnpm" | "yarn" | "bun";
  hasDockerfile: boolean;
  hasCI: boolean;
}

interface DiagnosticReport {
  score: number;
  overallReady: boolean;
  passedCount: number;
  warnCount: number;
  errorCount: number;
  categories: Record<string, { score: number; checks: CheckResult[] }>;
}

interface CheckResult {
  name: string;
  status: "pass" | "warn" | "fail";
  message: string;
  remediation?: string;
}

interface ScoringResult {
  overall: number;
  categories: Record<string, number>;
}

interface SBOM {
  components: Array<{
    name: string;
    version: string;
    purl: string;
  }>;
}

interface FixResult {
  actions: Array<{
    category: string;
    file: string;
    action: string;
  }>;
}
Section 8

Reusable GitHub Actions Workflows

Reference centralized, production-grade workflows maintained in Waiyat/devops directly from your repository.

.github/workflows/ci.yml
name: CI Quality Gate

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  ci:
    uses: Waiyat/devops/.github/workflows/reusable-ci.yml@main
    with:
      node-version: '22'
      package-manager: 'pnpm'
      run-build: true
      run-test: true
      run-audit: true

  security:
    needs: [ci]
    uses: Waiyat/devops/.github/workflows/reusable-security.yml@main

Available Reusable Workflows

  • ✓reusable-ci.yml — Multi-runtime quality gate (lint, test, build, audit, coverage)
  • ✓reusable-cd-docker.yml — Multi-arch Docker buildx & GHCR/DockerHub publishing
  • ✓reusable-security.yml — Aqua Trivy SAST scanner & GitLeaks secret detector
  • ✓reusable-release.yml — Semantic release & changelog generator
Section 9

Diagnostics & Health Scoring

Six diagnostic categories with weighted scoring for comprehensive repository health assessment.

Quality & Runtime

Comprehensive checks for quality & runtime readiness and compliance.

CI/CD Automation

Comprehensive checks for ci/cd automation readiness and compliance.

DevSecOps & Secrets

Comprehensive checks for devsecops & secrets readiness and compliance.

Containers & Docker

Comprehensive checks for containers & docker readiness and compliance.

Environment

Comprehensive checks for environment readiness and compliance.

Observability

Comprehensive checks for observability readiness and compliance.

Score Interpretation

80-100Healthy — Ready for production delivery
50-79Needs attention — Run npx @waiyat/devops@latest fix
0-49Critical — Immediate remediation required
Section 10

Troubleshooting & FAQ

Common questions and solutions for using @waiyat/devops.

How do I test a generated workflow without creating a commit?

Use the --dry-run flag: npx @waiyat/devops@latest init --template nextjs --dry-run to preview the YAML directly in your terminal.

How do I customize the generated workflow?

The CLI detects the active package manager and runtime from your repository. Choose a workflow shape with --template, and use --output to change the target path: npx @waiyat/devops init --template node --output .github/workflows/quality.yml.

Why am I getting a cached v2.x binary with npx?

Always append @latest to force npx to fetch v3.0.0: npx @waiyat/devops@latest check.

What Node.js version is required?

Minimum Node.js v18.0.0 (v20+ LTS recommended) is required for v3.0.0.