orchestrate:ci

flowchart TD
    START(["/orchestrate:ci"]) --> READ["Read plan + scan report"]:::orch
    READ --> DETECT["Detect tech stack + CI gaps"]:::orch
    DETECT --> T1["Tier 1: Universal checks"]:::orch
    T1 --> T2{"Tier 2 needed?"}
    T2 -->|Yes| T2_GEN["Tier 2: Conditional checks"]:::orch
    T2 -->|No| T3
    T2_GEN --> T3{"Tier 3 needed?"}
    T3 -->|Yes| T3_GEN["Tier 3: Advanced patterns"]:::orch
    T3 -->|No| BRANCH
    T3_GEN --> BRANCH["Create branch"]:::orch
    BRANCH --> SIZE{Under 700 lines?}
    SIZE -->|Yes| PR["Commit + open PR"]:::orch
    SIZE -->|No| SPLIT["Split into sub-PRs"]:::orch
    SPLIT --> PR
    PR --> DONE([Phase complete])

    classDef orch fill:#FF9800,stroke:#333,color:white

Follow this diagram as the workflow.

Orchestrate: CI

Add comprehensive CI workflows to a target repository. This is Phase 4 and produces PR #3. Covers lint, test, build, security scanning, dependency management, and supply chain hardening.

When to Use

• After orchestrate:plan identifies CI as a needed phase
• After precommit and tests phases (so CI can run the test suite)

Prerequisites

• Plan exists at /tmp/rossoctl/orchestrate/<target>/plan.md
• Scan report at /tmp/rossoctl/orchestrate/<target>/scan-report.md
• Target repo in .repos/<target>/

Read Scan Report First

Before generating anything, read the scan report to determine:

• Tech stack (Python, Go, Node, Ansible, Rust, multi-language)
• Existing CI workflows (what to preserve vs replace)
• Dockerfiles present (triggers container build workflows)
• Existing dependabot config (what ecosystems are covered)
• Existing security scanning (what's already in place)

---

Tier 1: Universal Checks (Always Generate)

Every repo gets these regardless of tech stack.

1.1 Core CI Workflow (ci.yml)

Trigger: pull_request on main and push to main

Adapt to tech stack from scan report:

Language	Lint	Test	Build
Python	ruff check . + ruff format --check .	pytest -v	uv build (if pyproject.toml has build-system)
Go	golangci-lint run	go test ./... -v -race	go build ./...
Node	npm run lint	npm test	npm run build
Rust	cargo clippy -- -D warnings	cargo test	cargo build --release
Ansible	ansible-lint	molecule test (if molecule config exists)	—