Pipelines
This site is built, deployed, and governed by atoms. The pipeline atoms and workflow compositions below are the same primitives cataloged at pipeline-atoms.com and workflow-atoms.com — this is the ecosystem eating its own cooking.
How this ecosystem is built
Every *-atoms.com catalog — including this site — runs these
workflow compositions end-to-end on every PR and merge.
1.0.0 Standard CI/CD pipeline for every *-atoms.com catalog site: type-check and build on PR, deploy to Cloudflare Pages on merge to main, create tagged release for semver tags.
secret-scan → ci → deploy → release workflow-atoms/workflows/atoms-catalog-cicd 1.0.0 Automated governance for every *-atoms repo: one-shot bootstrap on first push, weekly label sync from repo-standards, automatic issue triage via copilot+rest agent.
bootstrap → label-sync → label-cleanup → triage workflow-atoms/workflows/repo-governance 1.0.0 Minimum security checks for every *-atoms catalog site: secret detection with TruffleHog on every push and PR.
secret-scan workflow-atoms/workflows/security-baseline 1.0.0 Full Terraform lifecycle for *-atoms catalog infrastructure: plan on PR → apply on approval → optional destroy. Uses R2 state backend, Cloudflare DNS token, and OpenTofu CLI.
tf-plan → review-gate → tf-apply → verify workflow-atoms/workflows/terraform-lifecycle Pipeline atoms
Individual, typed, reusable CI/CD steps — the building blocks that compose into workflows.
gate (1)
gate stable Deployment gate that blocks forward progress until all required CI checks have passed. Evaluates the GitHub Actions 'needs' context to confirm every upstream job concluded with 'success'. A single upstream failure causes this gate to fail, preventing any deploy step from running. Implements Code.md §11.10: 'Merge before CI green defeats Code.md §3.'
github (12)
github stable Registers a custom domain (e.g. pipeline-atoms.com) with an existing Cloudflare Pages project via the Cloudflare API. Fires on workflow_dispatch with inputs for project name and domain. Used by every *-atoms catalog repo during initial site provisioning.
workflow_dispatchgithub stable Fires only when github.run_number == 1 (the very first push to a new repo). Installs canonical labels from repo-standards and runs bootstrap setup tasks. Self-skips on all subsequent pushes via the run_number condition.
pushgithub stable Continuous integration pipeline for *-atoms catalog sites: runs TypeScript type-check, Astro build, and Lighthouse performance audit. Fires on every push and pull_request to catch regressions before merge.
push, pull_requestgithub stable Deploys a *-atoms catalog site to Cloudflare Pages on every push to the main branch. Requires CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID org-level secrets.
pushgithub stable Migrates non-standard labels to their canonical aliases defined in repo-standards. Detects diverged labels, renames them, and removes true duplicates. Runs every Monday at 08:00 UTC and on workflow_dispatch.
schedule, workflow_dispatchgithub stable Installs the canonical agile label set (agile/epic, agile/feature, agile/story, agile/task, status/*, type/*) from convergent-systems-co/repo-standards. Runs on workflow_dispatch and on a weekly schedule to keep repos aligned with the governance standard.
workflow_dispatch, schedulegithub stable Runs on semver tag push (v*): builds the site, deploys to Cloudflare Pages, and creates a GitHub Release with auto-generated release notes. Implements the tag→deploy→release step of Code.md §11.10.
taggithub stable Runs TruffleHog secret detection on every push and pull_request to prevent credentials, API keys, and tokens from entering the codebase. Fails the workflow on any verified finding.
push, pull_requestgithub stable Applies Terraform/OpenTofu changes via workflow_dispatch with an explicit confirmation gate (inputs: env=[dev|stg|prod], confirm must equal 'apply'). Prevents accidental applies; the confirm check is enforced in the job condition before any state mutation.
workflow_dispatchgithub stable Creates a Cloudflare DNS CNAME record for a *-atoms.com domain via the Cloudflare API. Used during the DNS/Terraform sprint to wire custom domains to Cloudflare Pages projects. Fires on workflow_dispatch with inputs for zone, name, and target.
workflow_dispatchgithub stable Runs OpenTofu/Terraform plan in a matrix across dev, stg, and prod environments on pull_requests that touch infra/terraform/**. Posts plan output as a PR comment. Does not apply — plan only.
pull_requestgithub stable Automatically triages new and edited issues by applying the agile label hierarchy (epic/feature/story/task) and status labels. Delegates to the convergent-systems-co/repo-standards shared triage workflow via workflow_call. Fires on issues (opened, edited, reopened), issue_comment, and workflow_dispatch.
issues, issue_comment, workflow_dispatchstage (1)
stage stable Validation stage that runs the atoms catalog validator (validate_atoms.py) against all atom JSON files in the repo. Confirms schema conformance, required field presence, and SemVer format for every atom before any build or deploy step proceeds.
step (1)
step stable Install Node.js dependencies from the lockfile using 'npm ci'. Fails fast if package-lock.json is absent or out of sync with package.json. Produces a reproducible, clean node_modules from the pinned lockfile — never hoists or deduplicates beyond what the lockfile specifies.
All workflow compositions
Additional compositions for the broader ecosystem.
Publish the atoms catalog: validate all atoms, build and sign the export artifact, push a release tag, and deploy the catalog website.
checkout → validate → schema-valid-gate → build-exports → sign → push-tag → deploy-site Standard CI pipeline: check out the repository, install dependencies, run linting/validation, compile the build artifact, and upload it for downstream jobs.
checkout → install → validate → build → upload Automatically review and merge Dependabot pull requests: filter out major version bumps for manual review, run the test suite, and merge if tests pass.
checkout → filter-major → not-major-gate → install → test → tests-pass-gate → merge Build a Node/Astro site and deploy it to Cloudflare Pages via Wrangler. Requires CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID in the environment.
checkout → install → build → deploy Structured incident response workflow: detect and alert on-call, collect a diagnostic snapshot, apply a mitigation action, and produce a post-mortem document.
page-oncall → diagnose → mitigate → post-mortem The core Olympus agentic execution loop. Executes up to 20 iterations of: policy-gate → invoke-LLM → parse-tool-calls → execute-tools → append-results → check-termination. Used by the Zeus toolloop and all Pantheon module orchestration.
policy-gate → invoke-llm → parse-tool-calls → execute-tools → append-results → termination-gate The core Olympus agent loop: receive prompt → invoke LLM → parse tool calls → execute → repeat until no tool calls or max iterations reached. Gates a policy broker check before each tool dispatch.
policy-gate → invoke-llm → parse-tool-calls → execute-tools → append-results → termination-gate New developer onboarding workflow: clone all project repositories, install dependencies, run the test suite to verify the environment, and provision development secrets.
clone-repos → install-deps → run-tests → tests-pass-gate → setup-secrets Standard delivery cycle: push the feature branch, open a pull request, wait for CI to go green, then merge. Implements the full worktree+branch → push → PR → CI → merge lifecycle.
push-branch → create-pr → wait-for-ci → merge-pr Tag a release: verify the main branch is clean and up to date, create an annotated git tag, then trigger the downstream release workflow.
validate-clean-main → create-tag → trigger-release Migrate atoms to a new schema version: audit existing atoms, validate them against the new schema, fix non-conforming atoms, and regenerate the catalog export.
audit → validate → fix-nonconforming → schema-valid-gate → regenerate Run a secret scan (trufflehog) and a dependency vulnerability audit. Gates block the pipeline if secrets are found or high-severity vulnerabilities are present.
checkout → secret-scan → no-secrets-gate → dep-audit → no-high-severity-gate Full incident response lifecycle: declare → assess → mitigate → resolve → post-mortem. Uses incident-commander persona, SRE identity, and prod-read-only policy by default.
declare-incident → page-oncall → assess-blast-radius → mitigate → verify-resolution → post-mortem Generate a structured runbook for a given service or failure mode. Uses runbook-author persona with documentation-writer voice.
gather-service-context → identify-failure-modes → draft-runbook → validate-runbook → publish-runbook For AI agents
Fetch /pipelines.json for the machine-readable
pipeline and workflow catalog. Catalog sources:
pipeline-atoms.com/ai/index.json ·
workflow-atoms.com/ai/index.json.