name: devops-workflow-engineer description: > Use when designing GitHub Actions workflows, creating CI/CD pipelines, planning multi-environment deployments, optimizing pipeline cost and execution time, or implementing deployment strategies (blue-green, canary, rolling). Generates production-ready workflow YAML, analyzes existing pipelines for optimization, and creates deployment plans. license: MIT + Commons Clause metadata: version: 1.1.0 author: borghei category: engineering domain: devops updated: 2026-04-02 tags: [github-actions, ci-cd, deployment, workflows] python-tools: workflow_generator.py, pipeline_analyzer.py, deployment_planner.py tech-stack: python, github-actions, yaml, ci-cd

DevOps Workflow Engineer

The agent generates GitHub Actions workflow YAML, analyzes existing pipelines for optimization opportunities, and creates deployment plans with strategy selection, health checks, and rollback procedures.

Quick Start

# Generate a CI workflow
python scripts/workflow_generator.py --type ci --language python --test-framework pytest

# Analyze existing pipelines for optimization
python scripts/pipeline_analyzer.py .github/workflows/ --format json

# Plan a deployment strategy
python scripts/deployment_planner.py --type webapp --environments dev,staging,prod --strategy canary

Tools Overview

All tools support --format json and --output for file writing.

Workflow 1: CI Pipeline Design

The agent generates pipelines following fail-fast ordering:

1. Lint and format (~30s) -- cheapest gate first
2. Unit tests (~2-5m) -- matrix across versions
3. Build verification (~3-8m)
4. Integration tests (~5-15m, parallel with build)
5. Security scanning (~2-5m)

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: make lint

  test:
    needs: lint
    strategy:
      matrix:
        python-version: ['3.10', '3.11', '3.12']
    steps:
      - uses: actions/setup-python@v5
        with: { python-version: "${{ matrix.python-version }}", cache: pip }
      - run: pip install -r requirements.txt
      - run: pytest --junitxml=results.xml

  security:
    needs: lint
    steps:
      - run: pip-audit -r requirements.txt

CI targets:

Workflow 2: CD Pipeline and Multi-Environment Deployment

python scripts/deployment_planner.py --type webapp --environments dev,staging,prod --format json

Environment promotion flow:

Build -> Dev (auto) -> Staging (auto) -> Production (manual approval)
                                              |
                                        Canary (10%) -> Full rollout

Key CD rules:

• Build once, deploy the same artifact everywhere
• Tag artifacts with commit SHA for traceability
• Use environment protection rules for production gates
• Maintain rollback capability at every stage

Workflow 3: Pipeline Optimization

python scripts/pipeline_analyzer.py .github/workflows/ --format json -o report.json

The agent checks for:

1. Missing caching -- dependencies reinstalled every run
2. No timeouts -- stuck jobs burn budget
3. Sequential chains that could parallelize
4. Deprecated actions with newer versions available
5. Security issues -- secrets in logs, missing permissions scoping
6. Cost inefficiency -- oversized runners, no path filtering

Optimization techniques:

Path-based filtering -- skip CI for docs-only changes:

on:
  push:
    paths: ['src/**', 'tests/**', 'requirements*.txt']
    paths-ignore: ['docs/**', '*.md']

Concurrency cancellation -- cancel superseded runs:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

Dependency caching:

- uses: actions/cache@v4
  with:
    path: ~/.cache/pip
    key: ${{ runner.os }}-deps-${{ hashFiles('**/requirements.txt') }}

Deployment Strategies

Decision tree:

Zero-downtime required?
  No  -> Rolling deployment
  Yes -> Need instant rollback?
    No  -> Rolling with health checks
    Yes -> Budget for 2x infrastructure?
      Yes -> Blue-green
      No  -> Canary

Canary traffic split schedule:

GitHub Actions Patterns

Reusable workflows -- define once, call everywhere:

# .github/workflows/reusable-deploy.yml
on:
  workflow_call:
    inputs:
      environment: { required: true, type: string }
      image_tag: { required: true, type: string }
    secrets:
      DEPLOY_KEY: { required: true }

OIDC authentication -- no long-lived credentials:

permissions:
  id-token: write
  contents: read
steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789:role/github-actions
      aws-region: us-east-1

Secrets hierarchy: Organization > Repository > Environment. Never echo secrets; use add-mask for dynamic values. Prefer OIDC for cloud auth.

Runner Cost Optimization

Monthly estimate: (runs/day) x (avg min/run) x 30 x (cost/min) Example: 50 pushes/day x 8 min x 30 = 12,000 min x $0.008 = $96/month.

Anti-Patterns

Troubleshooting

References

Integration Points

Last Updated: April 2026 Version: 1.1.0