DevOps Agentic Workflows

Cross-cutting GitHub Agentic Workflow workflows for repository-wide DevOps automation.

The workflow source files live in .github/workflows/ and are compiled with gh aw compile to generate .lock.yml files (standard GitHub Actions YAML with security hardening). These workflows monitor the entire repo (all components, all pipelines, all PRs).

Available Workflows

Workflow	Description	Trigger
devops-health-check	Daily orchestrator that collects repo infrastructure health signals (pipelines, CI/CD infrastructure, resource usage), computes a fingerprint-based diff against the previous run, and updates a pinned health dashboard issue	`cron: 0 3 * * *` (03:00 UTC daily), `workflow_dispatch`
devops-health-investigate	Worker agent dispatched by the health check orchestrator to perform deep root-cause analysis on individual findings	`workflow_dispatch` (dispatched by orchestrator via `dispatch-workflow`)
devops-health-groom	Runs ~3h after the health check to link investigation results into the issue body, hide stale comments (>7 days), and clean up resolved investigations	`cron: 0 6 * * *` (06:00 UTC daily), `workflow_dispatch`
issue-triage	Triages individual issues: assigns an `area-*` label, identifies owners from CODEOWNERS, adds the `Triaged` label, and posts a brief actionable summary	`issues: [opened, reopened]`, `workflow_dispatch`
issue-triage-batch	Deterministic workflow that dispatches the issue-triage agent for each untriaged issue in an optional date range	`workflow_dispatch` (with optional `date_from`/`date_to`)
issue-investigate	Deep investigation agent that analyzes an issue against the codebase, suggests next steps, and creates a draft PR if the fix is clear	`issues: [labeled]` (when `auto-investigate` label is added)

Architecture

devops-health-check (Orchestrator) ─── runs daily
  ├─ Collects health signals from 3 categories:
  │   Pipeline · Infrastructure · Resources
  ├─ Fingerprints each finding for stable diff tracking
  ├─ Classifies: 🆕 NEW · 📌 EXISTING · ✅ RESOLVED
  ├─ Updates pinned health dashboard issue
  └─ Dispatches investigation workers (up to 10)
       │
       ▼
devops-health-investigate (Worker × N) ─── dispatched
  ├─ Investigates ONE finding with fresh context
  ├─ Follows category-specific playbook
  ├─ Determines root cause + remediation
  └─ Posts investigation results as a comment on the health issue
       │
       ▼  (~3 hours later)
devops-health-groom (Groomer) ─── runs daily
  ├─ Links investigation comments into the issue body
  │   (updates 🔄 Dispatched → ✅ Done with summary + link)
  ├─ Marks resolved investigations as ✅ Resolved
  ├─ Hides (collapses) daily overview comments older than 7 days
  └─ Hides (collapses) investigation comments for resolved findings

Setup

Install the gh aw CLI extension: gh extension install github/gh-aw
Compile: gh aw compile (from the repo root — this compiles all .md files in .github/workflows/)
Commit both the .md and generated .lock.yml files
The health check runs daily, or on-demand via workflow_dispatch

Local Development

# Compile workflows (generates .lock.yml from .md frontmatter)
gh aw compile

# Compile with validation
gh aw compile --strict

# Dry-run (validates without triggering on GitHub Actions)
gh aw run devops-health-check --dry-run

# Run on GitHub Actions (from a pushed branch)
gh aw run devops-health-check --push --ref <branch>

File Structure

.github/
├── workflows/
│   ├── devops-health-check.md              # Orchestrator workflow
│   ├── devops-health-check.lock.yml        # Compiled workflow (generated by gh aw compile)
│   ├── devops-health-investigate.md        # Worker workflow
│   ├── devops-health-investigate.lock.yml  # Compiled workflow (generated by gh aw compile)
│   ├── devops-health-groom.md              # Grooming workflow
│   ├── devops-health-groom.lock.yml        # Compiled workflow (generated by gh aw compile)
│   ├── issue-triage.md                     # Issue triage agent
│   ├── issue-triage.lock.yml               # Compiled workflow (generated by gh aw compile)
│   ├── issue-triage-batch.yml              # Batch triage dispatcher (standard GHA)
│   ├── issue-investigate.md                # Deep issue investigation agent
│   └── issue-investigate.lock.yml          # Compiled workflow (generated by gh aw compile)
└── aw/
    └── shared/
        ├── devops-health.lock.md       # Health check catalog & fingerprinting rules
        └── devops-investigate.lock.md  # Investigation playbooks & remediation templates

5.1 KiB Raw Blame History Unescape Escape