ci-cd

KeygraphHQ/shannon

An AI agent that pentests code and only reports proven exploits — Shannon is an open-source agent that reads your source code, maps attack paths, and actually executes exploits against web apps and APIs rather than just flagging suspected issues—no exploit, no report. Run it locally via npx for CI/CD or pre-production security checks; useful for appsec and devsecops teams wanting automated, evidence-based pentesting.

harness/harness

Harness Open Source Expands Drone Into a Full DevOps Platform — Harness is the open source successor to Drone, bundling Git hosting, CI/CD pipelines, hosted dev environments (Gitspaces), and artifact registries into one self-hostable platform. It runs as a single Docker container, making it relevant for teams who want Drone-style pipelines plus SCM and dev environments without stitching together separate tools.

gitleaks/gitleaks

Gitleaks enters maintenance mode, focus shifts to Betterleaks — Gitleaks scans git repos, files, and stdin for secrets like passwords and API keys using regex-based detection. The maintainer has declared it feature-complete, limiting future releases to security patches while development moves to a new project called Betterleaks. Useful for DevSecOps teams running CI/CD secret scanning today.

promptfoo/promptfoo

Promptfoo's LLM Evals and Red Teaming, Now Backed by OpenAI — Promptfoo is a CLI and library for evaluating and red-teaming LLM apps, agents, and RAGs, with declarative configs that plug into CI/CD. It recently became part of OpenAI while staying open source and MIT licensed, and is used by OpenAI and Anthropic to catch vulnerabilities before shipping.

argoproj/argo-cd

GitOps-driven continuous delivery for Kubernetes clusters — Argo CD syncs application state from Git to Kubernetes clusters, keeping deployments declarative, versioned and auditable. It suits teams wanting automated, Git-based rollout and lifecycle management of apps defined via Helm, Kustomize or Jsonnet, backed by an active CNCF community and live demo.

dagger/dagger

Programmable, containerized CI/CD that replaces shell scripts and YAML — Dagger replaces ad hoc shell scripts and YAML pipelines with a typed, containerized execution engine. It offers SDKs in 8 languages, a REPL, reusable modules, and built-in OpenTelemetry tracing, letting developers run identical workflows locally, in CI, or in the cloud.

Tracer-Cloud/opensre

An open toolkit for building AI SRE agents, not just buying one — OpenSRE is a public-alpha framework for building and training AI SRE agents, with an evaluation environment to improve them. It connects 60+ existing tools like Datadog, Grafana and Slack, letting teams define custom workflows for root-cause analysis and remediation on their own infrastructure.

openchoreo/openchoreo

A ready-made internal developer platform for Kubernetes, now CNCF Sandbox — OpenChoreo bundles higher-level Kubernetes abstractions, a Backstage portal, CI/CD, GitOps, and observability into one platform instead of a toolkit you assemble yourself. It targets both developers wanting self-service and platform engineers wanting control, and it explicitly supports AI agents building and operating workloads alongside humans.

jwuthri-cloud/Tracely-ai

Turn real agent failures into CI gates, not hand-written test sets — Tracely grades live AI agent traces, clusters failures into issues, and freezes the actual bad runs into hermetic regression tests that replay on every PR, blocking regressions automatically. Self-hostable stack (API, worker, UI, Postgres, ClickHouse, Redis, MinIO) aimed at teams tired of hand-authoring eval datasets.

necoz-oss/changelog-bot

AI changelog generator that opens PRs for you, no API key required — changelog-bot turns commit history, PR titles, and release notes into a ready-to-ship changelog entry, optionally opening a PR with compare links already wired up. It works with OpenAI or Anthropic for tone-aware summaries, but falls back to a heuristic generator if no API key is set, so releases never fail because AI is down. Ships as a CLI, GitHub Action, or reusable workflow.