DOCSEARCHbyAlgolia
Submit Docs

Git-Ape Platform Engineering Framework

repository·main·Indexed 42 days ago

https://github.com/azure/git-ape

A platform engineering framework built on GitHub Copilot that uses a multi-agent system to plan, validate, and deploy Azure workloads. Available as a VS Code extension and Copilot CLI plugin, it automates the Azure deployment lifecycle—including requirement gathering, ARM template generation, security/cost analysis, and post-deployment validation—through a structured four-stage pipeline (Gather, Generate, Confirm, Deploy).

Tokens
114.5K
Snippets
258
Records
508
Agent score
54%

What's inside Git-Ape

  2. Overview of the 'Deploy Like a Pro' Workshop

    main

    The 'Deploy Like a Pro' workshop is an intermediate-level training track (approximately 60 minutes) designed to teach the deployment of multi-resource architectures using Git-Ape. It focuses on implementing security gates, cost estimation, and drift detection within Azure environments.

    The workshop is divided into five labs:

    1. Lab 1: Onboarding: Setting up OIDC, RBAC, and GitHub environments.
    2. Lab 2: Web App + SQL: Deploying a web app integrated with a SQL database and Key Vault.
    3. Lab 3: Security Deep Dive: Testing security gates by intentionally breaking security, observing the gate block, and performing a fix-and-re-deploy.
    4. Lab 4: Cost & Architecture: Running cost estimation and performing WAF (Web Application Firewall) architecture reviews.
    5. Lab 5: Drift Detection: Introducing resource drift, detecting it, and performing reconciliation.

  3. What is Git-Ape?

    main

    Git-Ape is an AI assistant designed to transform plain English descriptions into production-ready Azure cloud infrastructure. It is built on GitHub Copilot and operates within your editor or browser.

    Key features include:

    • Automated Security: Handles security configurations automatically.
    • Cost Estimation: Provides cost analysis for the requested infrastructure.
    • Architecture Documentation: Automatically generates documentation for the deployed resources.
    • Low Barrier to Entry: Designed to work without requiring deep cloud expertise or manual writing of ARM templates/IaC.

  4. Overview of the Track 3: Platform Engineering Workshop

    main

    The Track 3: Platform Engineering workshop is an advanced 90-minute session focused on mastering the full CI/CD lifecycle using Git-Ape. It covers PR-based deployment workflows, headless mode for automated infrastructure deployment via GitHub Issues, multi-environment promotion (dev → staging → prod), policy compliance assessment (CIS/NIST), IaC resource export, and lifecycle teardown.

    Lab Curriculum

    • Lab 1: CI/CD Pipeline (20 min): PR-based plan, review, and deploy workflows.
    • Lab 2: Headless Mode (15 min): Automating the flow from GitHub Issue to auto-generated PR to deployment.
    • Lab 3: Multi-Environment (15 min): Implementing promotion strategies across dev, staging, and prod.
    • Lab 4: Policy Compliance (15 min): Assessing Azure Policy compliance against CIS/NIST frameworks.
    • Lab 5: IaC Export (10 min): Exporting existing Azure resources to Infrastructure as Code.
    • Lab 6: Destroy Lifecycle (5 min): Executing a full teardown via a PR-based workflow.

  5. Executive benefits of Git-Ape

    main

    Git-Ape provides automated compliance, cost visibility, and security enforcement for Azure deployments. It implements a 'continuous compliance' model where every deployment produces a verifiable trail (intent → plan → API calls → validation → evidence) that is reviewed and approved as code.

    Key value drivers include:

    • Compliance Without Friction: Automated Azure Policy assessment (CIS, NIST), mandatory security gates for Critical/High severity checks, and WAF 5-pillar scoring (Security, Reliability, Performance, Cost, and Operational Excellence).
    • Cost Governance: Pre-deployment cost estimation using the Azure Retail Prices API, providing per-resource breakdowns and monthly totals to prevent unexpected cloud bills.
    • Risk Reduction: Enforcement of managed identities (no connection strings/shared keys), least-privilege RBAC, drift detection for unauthorized manual changes, and OIDC authentication to eliminate stored secrets in CI/CD pipelines.

  6. Overview of Git-Ape Prompts

    main

    Git-Ape uses parametric commands (prompts) located in .github/prompts/ to manage the authoring lifecycle of skills and agents. These prompts wrap the core workflow: scaffolding evaluation suites, cross-model benchmarking, iterative quality improvement, and readiness assessment for promotion.

    Important: Use these prompts during authoring to ensure every skill and agent is grounded in measurable evaluations from the first commit. Drafting files like SKILL.md or .agent.md without running the corresponding onboard prompts is discouraged.

    Cost Warning: Every prompt invokes waza run one or more times. Benchmarking and promotion prompts run across multiple models (defaulting to four), and improvement loops can run up to three rounds. Plan your quota accordingly.

  8. What is Agentic Resource Discovery (ARD)?

    main

    Agentic Resource Discovery (ARD) is an open protocol that allows AI agents to discover skills and tools published by organizations, similar to how DNS allows browsers to discover websites. An AI agent queries an ARD catalog endpoint to find available skills, read their descriptions, and invoke them automatically.

    Git-Ape implements this by publishing an ai-catalog.json file containing its skill definitions.

  9. How the Security Gate decision process works

    main

    Git-Ape implements a blocking security gate for every deployment. The process follows this lifecycle:

    1. Analysis: Once an ARM Template is generated, the Security Analyzer runs a full analysis against the template.
    2. Evaluation: The gate checks if all Critical and High severity checks have passed.
    3. Outcome:
      • If all Critical and High checks pass, the status is 🟢 SECURITY GATE: PASSED and deployment proceeds.
      • If any Critical or High checks fail, the status is 🔴 SECURITY GATE: BLOCKED and deployment is halted.
    4. Resolution: If blocked, you have three options to reach a PASSED state:
      • Accept auto-fixes: Allow the agent to apply fixes and re-run analysis.
      • Provide alternative settings: Manually provide compliant configuration settings and re-run analysis.
      • Override: Explicitly state 'I accept the security risk'. This will result in the gate being OVERRIDDEN and allows the deployment to proceed (this action is logged).

  10. Determine when to use Azure Policy Advisor

    main

    Use azure-policy-advisor when you need to align deployments with governance frameworks or determine which policies should be applied to a specific set of resources.

    Use Cases

    • Recommending Azure Policy assignments for an ARM template.
    • Auditing a subscription against CIS Azure Foundations, NIST SP 800-53, or general best practices.
    • Deciding which initiatives to assign at the subscription or management-group scope.
    • Identifying which policy gaps are "template-fixable" versus those that require platform-level governance.
    • Recommending baseline policy assignments for a new subscription.

    When NOT to use it

    • Per-resource security configuration assessment (e.g., checking for HTTPS-only or TLS versions) $\rightarrow$ use azure-security-analyzer.
    • RBAC role recommendations $\rightarrow$ use azure-role-selector.
    • CAF naming conventions $\rightarrow$ use azure-naming-research.
    • Pricing or cost estimation $\rightarrow$ use azure-cost-estimator.
    • VM SKU, API version, or quota checks $\rightarrow$ use azure-resource-availability.
    • Configuration drift detection (comparing deployed state vs template) $\rightarrow$ use azure-drift-detector.
    • Generating ARM templates $\rightarrow$ use Azure Template Generator.

  11. Multi-Environment Deployment Strategy

    main

    The recommended pattern for multi-environment management (Dev, Staging, Prod) uses isolation and promotion gates:

    • Isolation: Use separate Azure subscriptions per environment to minimize blast radius.
    • Configuration: Use environment-specific parameter files for the same ARM templates.
    • Security: Use OIDC credentials scoped specifically to each GitHub environment.
    • Promotion: Use GitHub environment protection rules to govern deployment:
      • Dev: Automatic deployment on merge to a sandbox subscription.
      • Staging: Requires one approver; uses a staging subscription.
      • Prod: Requires two approvers plus a wait timer; uses a production subscription with higher SKUs and geo-redundancy.

  12. Manage Infrastructure Lifecycle and State

    main

    Git-Ape tracks the complete lifecycle of resources within the .azure/deployments/ directory.

    Lifecycle States:

    • planning
    • deployed
    • drift-detected
    • reconciled
    • destroyed

    Teardown via Pull Request: To delete resources, update metadata.json to set destroy-requested. Once the PR is merged, git-ape-destroy.yml will automatically delete the resources while preserving the audit trail.