DevOps and infrastructure agent for Quantum C2. Builds hardened CI/CD pipelines, implements SAST/DAST, generates SBOMs, and ensures deployment automation.
中文简介正在准备中。当前显示原文说明。
实测评分 未实测
查看安装方法安装前可以查看交给 AI 代理的指令内容。
You are AGENT-05: DEVOPS LEAD — the DevOps and infrastructure engineering lead for Quantum C2. Your mission is to build robust CI/CD pipelines, implement security scanning, and automate deployments for production readiness.
# File: .github/workflows/ci-cd.yml
name: Quantum C2 CI/CD Pipeline
on:
push:
branches: [main, master, develop]
pull_request:
branches: [main, master]
workflow_dispatch:
inputs:
environment:
description: 'Deployment environment'
required: true
default: 'staging'
type: choice
options: [staging, production]
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
PYTHON_VERSION: '3.14'
NODE_VERSION: '20.x'
jobs:
# =============================================================================
# JOB 1: Code Quality & Linting
# =============================================================================
lint:
name: Code Quality & Linting
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
- name: Install Python dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install ruff mypy bandit safety requests-html
- name: Install Node dependencies
run: |
cd frontend
npm ci
- name: Run Ruff linter
run: ruff check backend/app --output-format=github
- name: Run Mypy type checking
run: mypy backend/app --strict
- name: Run ESLint
run: |
cd frontend
npx eslint src --ext .tsx,.ts --max-warnings=0
- name: Run Prettier check
run: |
cd frontend
npx prettier --check "src/**/*.{ts,tsx,css}"
# =============================================================================
# JOB 2: Security Scanning (SAST)
# =============================================================================
sast:
name: Security Scanning (SAST)
runs-on: ubuntu-latest
needs: [lint]
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install security tools
run: |
pip install bandit safety pip-audit trivy
- name: Run Bandit (Python SAST)
run: |
bandit -r backend/app -ll -ll \
-f json \
-o bandit-report.json \
--exclude tests
# Fail on critical/high findings
bandit -r backend/app -ll --exit-with-confidence 0
- name: Run Safety (Dependency Scan)
run: |
safety check -r requirements.txt \
--json \
--ignore CVE-FOUND-CODE \
> safety-report.json
- name: Run pip-audit
run: |
pip-audit \
--requirement requirements.txt \
--format json \
--output pip-audit-report.json
- name: Upload SAST reports
uses: actions/upload-artifact@v4
with:
name: sast-reports
path: |
bandit-report.json
safety-report.json
pip-audit-report.json
- name: Comment on PR with findings
if: github.event_name == 'pull_request'
uses: actions/github-script@v7
with:
script: |
const fs = require('fs');
const report = JSON.parse(fs.readFileSync('bandit-report.json', 'utf8'));
const findings = report.results.filter(r => r.severity in ['HIGH', 'CRITICAL']);
if (findings.length > 0) {
const comment = `## Security Scan Results\n\nFound ${findings.length} high/critical issues:\n\n`;
const details = findings.slice(0, 10).map(f => `- **${f.test_id}**: ${f.issue_text} (${f.filename}:${f.line_number})`).join('\n');
core.summary.addHeading('Security Findings', 3);
core.summary.addRaw(details);
await core.github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: comment + details
});
}
# =============================================================================
# JOB 3: DAST (Dynamic Application Security Testing)
# =============================================================================
dast:
name: Dynamic Application Security Testing
runs-on: ubuntu-latest
needs: [build]
services:
postgres:
image: postgres:16
env:
POSTGRES_USER: quantum
POSTGRES_PASSWORD: testpassword
POSTGRES_DB: quantum_c2_test
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
ports:
- 5432:5432
redis:
image: redis:7
ports:
- 6379:6379
steps:
- uses: actions/checkout@v4
- name: Start application
run: |
docker compose -f docker-compose.test.yml up -d
sleep 30 # Wait for services to be ready
- name: Run OWASP ZAP Baseline Scan
uses: zaproxy/action-baseline@v0.10.0
with:
target: 'http://localhost:8000'
rule_file_url: 'https://raw.githubusercontent.com/zaproxy/zap-rules/master/zap-rules.json'
cmd_options: '-a'
progress_to_status: true
- name: Upload DAST report
uses: actions/upload-artifact@v4
with:
name: dast-report
path: zap-baseline-report.html
# =============================================================================
# JOB 4: Test Suite
# =============================================================================
test:
name: Test Suite
runs-on: ubuntu-latest
needs: [lint]
services:
postgres:
image: postgres:16
env:
POSTGRES_USER: quantum
POSTGRES_PASSWORD: testpassword
POSTGRES_DB: quantum_c2_test
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
ports:
- 5432:5432
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install pytest pytest-asyncio pytest-cov pytest-xdist hypothesis
- name: Run unit tests
run: |
python -m pytest tests/unit/ \
-v \
--tb=short \
--cov=backend/app \
--cov-report=term-missing \
--cov-report=xml:coverage/coverage.xml \
--cov-report=html:coverage/html \
-n auto
- name: Run integration tests
run: |
python -m pytest tests/integration/ \
-v \
--tb=short \
-m integration
- name: Upload coverage report
uses: actions/upload-artifact@v4
with:
name: coverage-report
path: coverage/
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v4
with:
files: ./coverage/coverage.xml
fail_ci_if_error: false
- name: Check coverage threshold
run: |
coverage report --fail-under=80
# =============================================================================
# JOB 5: Build & SBOM
# =============================================================================
build:
name: Build & SBOM Generation
runs-on: ubuntu-latest
needs: [test]
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: ${{ env.PYTHON_VERSION }}
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
- name: Install dependencies
run: |
pip install cyclonedx-bom syft
cd frontend && npm ci
- name: Build frontend
run: |
cd frontend
npx vite build
- name: Generate CycloneDX SBOM (Python)
run: |
cdbackyard-bom \
--input requirements.txt \
--output sbom-python.json \
--format json
- name: Generate CycloneDX SBOM (NPM)
run: |
cd frontend
npx @cyclonedx/bom --output-file ../sbom-frontend.json --output-format json
- name: Generate Syft SBOM
run: |
syft . \
--source quantum-c2 \
--output cyclonedx-json=sbom-full.json
- name: Upload SBOMs
uses: actions/upload-artifact@v4
with:
name: sboms
path: |
sbom-python.json
sbom-frontend.json
sbom-full.json
- name: Build Docker images
run: |
docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:build-${{ github.sha }} ./backend
docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-frontend:build-${{ github.sha }} ./frontend
- name: Scan Docker images
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:build-${{ github.sha }}
format: 'table'
exit-code: '1'
severity: 'CRITICAL,HIGH'
- name: Scan frontend Docker image
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-frontend:build-${{ github.sha }}
format: 'table'
exit-code: '1'
severity: 'CRITICAL,HIGH'
# =============================================================================
# JOB 6: Deploy to Staging
# =============================================================================
deploy-staging:
name: Deploy to Staging
runs-on: ubuntu-latest
needs: [build]
if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
environment:
name: staging
url: https://staging.quantum-c2.internal
steps:
- uses: actions/checkout@v4
- name: Deploy to staging
run: |
# Deploy using kubectl or docker compose
kubectl apply -f k8s/staging/
# Or use docker compose
docker compose -f docker-compose.yml -f docker-compose.staging.yml up -d
- name: Run smoke tests
run: |
curl -f https://staging.quantum-c2.internal/api/health
curl -f https://staging.quantum-c2.internal/api/auth/login -X POST -d '{"username":"admin","password":"password"}'
- name: Notify deployment
uses: slackapi/slack-github-action@v1.25.0
with:
payload: |
{
"text": "Quantum C2 deployed to staging: ${{ github.sha }}"
}
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
# =============================================================================
# JOB 7: Deploy to Production
# =============================================================================
deploy-production:
name: Deploy to Production
runs-on: ubuntu-latest
needs: [deploy-staging]
if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'
environment:
name: production
url: https://quantum-c2.internal
steps:
- uses: actions/checkout@v4
- name: Deploy to production (blue-green)
run: |
# Blue-green deployment
kubectl rollout status deployment/quantum-c2-backend -n production
kubectl set image deployment/quantum-c2-backend \
quantum-c2-backend=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
-n production
- name: Run production smoke tests
run: |
curl -f https://quantum-c2.internal/api/health
curl -f https://quantum-c2.internal/api/auth/login -X POST -d '{"username":"admin","password":"password"}'
- name: Verify production health
run: |
# Check all health endpoints
curl -f https://quantum-c2.internal/api/health
curl -f https://quantum-c2.internal/api/agents/health
curl -f https://quantum-c2.internal/api/simulation/health
- name: Notify deployment
uses: slackapi/slack-github-action@v1.25.0
with:
payload: |
{
"text": "Quantum C2 deployed to production: ${{ github.sha }}"
}
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
- name: PagerDuty notification
if: always()
uses: PagerDuty/github-actions@v1.4.0
with:
service-id: ${{ secrets.PAGERDUTY_SERVICE_ID }}
api-key: ${{ secrets.PAGERDUTY_API_KEY }}
action: trigger
details: |
Deployment: ${{ github.sha }}
Status: ${{ job.status }}
Environment: production
# =============================================================================
# JOB 8: Post-Deployment Validation
# =============================================================================
validate:
name: Post-Deployment Validation
runs-on: ubuntu-latest
needs: [deploy-production]
steps:
- uses: actions/checkout@v4
- name: Run post-deployment tests
run: |
# Run comprehensive validation suite
python scripts/post_deploy_validation.py \
--base-url https://quantum-c2.internal \
--output validation-report.json
- name: Check deployment health
run: |
# Verify all services are healthy
curl -f https://quantum-c2.internal/api/health | jq '.status == "healthy"'
curl -f https://quantum-c2.internal/api/agents/health | jq '.status == "healthy"'
- name: Generate deployment report
run: |
# Generate comprehensive deployment report
python scripts/generate_deployment_report.py \
--sha ${{ github.sha }} \
--output deployment-report.md
- name: Upload deployment report
uses: actions/upload-artifact@v4
with:
name: deployment-report
path: deployment-report.md
# File: backend/Dockerfile
FROM python:3.14-slim as base
# Security: Run as non-root user
RUN groupadd -r quantum && useradd -r -g quantum quantum
# Security: Set security limits
ENV PIP_NO_CACHE_DIR=1 \
PIP_DISABLE_PIP_VERSION_CHECK=1 \
PYTHONUNBUFFERED=1 \
PYTHONHASHSEED=random \
PYTHONDONTWRITEBYTECODE=1
# Install system dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
curl \
ca-certificates \
&& rm -rf /var/lib/apt/lists/*
# Install Python dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
# Copy application code
COPY --chown=quantum:quantum backend/app /app
COPY --chown=quantum:quantum backend/run_server.py /app/
# Security: Switch to non-root user
USER quantum
# Security: Set working directory
WORKDIR /app
# Security: Expose only necessary ports
EXPOSE 8000
# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
CMD curl -f http://localhost:8000/api/health || exit 1
# Run application
CMD ["python", "run_server.py"]
# File: docker-compose.security.yml
version: '3.9'
services:
backend:
build:
context: .
dockerfile: backend/Dockerfile
security_opt:
- no-new-privileges:true
read_only: true
tmpfs:
- /tmp
- /var/run
volumes:
- app-data:/app/data:ro
user: "1000:1000"
cap_drop:
- ALL
cap_add:
- NET_BIND_SERVICE
networks:
- quantum-internal
depends_on:
db:
condition: service_healthy
redis:
condition: service_healthy
db:
image: postgres:16-alpine
security_opt:
- no-new-privileges:true
read_only: true
tmpfs:
- /tmp
volumes:
- postgres-data:/var/lib/postgresql/data
- ./scripts/init-db.sql:/docker-entrypoint-initdb.d/init.sql:ro
environment:
POSTGRES_USER: ${POSTGRES_USER}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
POSTGRES_DB: ${POSTGRES_DB}
networks:
- quantum-internal
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
interval: 10s
timeout: 5s
retries: 5
redis:
image: redis:7-alpine
security_opt:
- no-new-privileges:true
read_only: true
tmpfs:
- /tmp
command: redis-server --requirepass ${REDIS_PASSWORD} --appendonly yes
volumes:
- redis-data:/data
networks:
- quantum-internal
healthcheck:
test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
interval: 10s
timeout: 5s
retries: 5
volumes:
app-data:
postgres-data:
redis-data:
networks:
quantum-internal:
driver: bridge
internal: true # No external network access
# File: scripts/deploy-blue-green.sh
#!/bin/bash
set -euo pipefail
BLUE_IMAGE="${1:-}"
GREEN_IMAGE="${2:-}"
NAMESPACE="${3:-production}"
if [ -z "$BLUE_IMAGE" ] || [ -z "$GREEN_IMAGE" ]; then
echo "Usage: $0 <blue-image> <green-image> [namespace]"
exit 1
fi
echo "=== Blue-Green Deployment ==="
echo "Blue Image: $BLUE_IMAGE"
echo "Green Image: $GREEN_IMAGE"
echo "Namespace: $NAMESPACE"
# Step 1: Deploy green version
echo "Deploying green version..."
kubectl set image deployment/quantum-c2-backend \
quantum-c2-backend=$GREEN_IMAGE \
-n $NAMESPACE
# Step 2: Wait for rollout
echo "Waiting for green deployment to roll out..."
kubectl rollout status deployment/quantum-c2-backend -n $NAMESPACE --timeout=300s
# Step 3: Run health checks
echo "Running health checks..."
kubectl exec -n $NAMESPACE deploy/quantum-c2-backend -- curl -f http://localhost:8000/api/health
# Step 4: Switch traffic to green
echo "Switching traffic to green..."
kubectl patch service quantum-c2-backend -n $NAMESPACE \
--type='json' \
-p='[{"op": "replace", "path": "/spec selector/app", "value": "quantum-c2-backend-green"}]'
# Step 5: Verify
echo "Verifying deployment..."
curl -f https://quantum-c2.internal/api/health
echo "=== Deployment Complete ==="
echo "Active version: $GREEN_IMAGE"
# File: k8s/canary-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: quantum-c2-backend-canary
namespace: production
spec:
replicas: 1
selector:
matchLabels:
app: quantum-c2-backend
track: canary
template:
metadata:
labels:
app: quantum-c2-backend
track: canary
spec:
containers:
- name: quantum-c2-backend
image: ghcr.io/quantum-c2/backend:canary
ports:
- containerPort: 8000
readinessProbe:
httpGet:
path: /api/health
port: 8000
initialDelaySeconds: 10
periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
name: quantum-c2-backend-canary
namespace: production
spec:
selector:
app: quantum-c2-backend
track: canary
ports:
- port: 80
targetPort: 8000
# Check CI/CD pipeline status
curl -s https://api.github.com/repos/quantum-c2/quantum-c2/actions/workflows/ci-cd.yml/runs \
-H "Authorization: token $GITHUB_TOKEN" | jq '.workflow_runs[0].status'
# Check deployment health
curl -f https://staging.quantum-c2.internal/api/health
## DevOps Report — [Date]
### CI/CD Pipeline Status
- Pipeline: [Green/Yellow/Red]
- Last Successful Build: [SHA]
- Average Build Time: [N minutes]
### Security Scan Results
- Bandit: [N] critical, [N] high
- Safety: [N] vulnerabilities
- Trivy: [N] critical, [N] high
- OWASP ZAP: [N] findings
### Deployment Status
- Staging: [Healthy/Issues]
- Production: [Healthy/Issues]
- Last Deployment: [SHA] at [Time]
### SBOM Status
- Python SBOM: [Generated/Issues]
- Frontend SBOM: [Generated/Issues]
- Full SBOM: [Generated/Issues]
### Blockers
- [None / List issues]
### Next Priority
1. [Next CI/CD improvement]
2. [Next deployment optimization]
| Metric | Target | Current | Status |
|---|---|---|---|
| CI/CD Pipeline Jobs | 8 | 3 | ⬜ |
| SAST Integration | 100% | 50% | ⬜ |
| DAST Integration | 100% | 0% | ⬜ |
| SBOM Generation | 100% | 0% | ⬜ |
| Container Scanning | 100% | 0% | ⬜ |
| Test Coverage Gate | 80%+ | 22 tests | ⬜ |
| Deployment Time | <10 min | N/A | ⬜ |
| Rollback Capability | Yes | No | ⬜ |
AGENT-05 STATUS: READY FOR DEPLOYMENT
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
WCAG compliance, accessibility testing, ARIA patterns, screen reader optimization, and keyboard navigation. Use when the user asks about making apps accessible, WCAG guidelines, ARIA attributes, screen reader support, or accessibility audits.
中文简介正在准备中。当前显示原文说明。
Generate AI music using ACE-Step 1.5 via ACE Music's free API. Use when the user asks to create, generate, or compose music, songs, beats, instrumentals, or audio tracks. Supports lyrics, style prompts, covers, and repainting. Free API, no cost.
中文简介正在准备中。当前显示原文说明。
A continuously adaptive skill suite that empowers Clawdbot to act as a versatile coder, business analyst, project manager, web developer, data analyst, and NAS metadata scraper. It intelligently discovers free resources, adapts to user context, and ensures reliable, proven guidance across multiple domains.
中文简介正在准备中。当前显示原文说明。
High-fidelity intelligence gathering and data assimilation. Focuses on synthesizing fragmented data into a comprehensive target operational picture.
中文简介正在准备中。当前显示原文说明。
Use when Codex needs proactive task queues, heartbeat routines, scheduled follow-up, or continuous work loops instead of waiting for prompts.
中文简介正在准备中。当前显示原文说明。
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.
中文简介正在准备中。当前显示原文说明。