DevOps Automation with DeepSeek Harness: Quality Gates, GitOps & Self-Healing

Chapter Overview

DevOps emphasizes collaboration between development and operations, using automation to improve software delivery efficiency. DSH (DeepSeek Harness) acts as an intelligent agent that integrates into the DevOps toolchain across the entire lifecycle: Plan → Code → Build → Test → Deploy → Operate. DSH participates in code review and quality checks, automated test case generation, documentation generation and maintenance, monitoring alert analysis and response, incident analysis and root cause identification, and infrastructure configuration review.

Automated Testing and Quality Gates

Code Quality Check Flow

A GitHub Actions workflow ( .github/workflows/quality-gate.yaml) triggers on pull requests to main and develop branches, ignoring markdown and docs changes. The pipeline runs eight sequential steps on ubuntu-latest with full git history ( fetch-depth: 0):

Type Check : npm run type-check (static TypeScript validation)

Lint Check : npm run lint (ESLint)

Unit Tests : npm run test:unit Integration Tests : npm run test:integration E2E Tests : npm run test:e2e (only on push events)

Coverage Check : npm run test:coverage with COVERAGE_THRESHOLD=80 Security Audit : npm audit --audit-level=high DSH AI Code Review : Uses a custom composite action ./.github/actions/dsh-code-review with inputs api-key (from secrets), model: deepseek-chat,

severity-threshold: high

DSH Code Review Action

The composite action ( .github/actions/dsh-code-review/action.yaml) defines three inputs: api-key (required), model (default deepseek-chat), severity-threshold (default high), and comment-mode (default failure). It runs two steps: a bash script review.sh that executes the review, then a github-script step that posts a PR comment if issues are found and fails the workflow if high-severity issues exist ( steps.review.outputs.has_high_severity == 'true').

Custom Quality Gate Implementation

A TypeScript class QualityGate ( src/quality-gate/index.ts) encapsulates configurable thresholds ( minCoverage, maxComplexity, maxCyclomaticComplexity, allowedSecurityIssues) and uses a DSAgent from @deepseek-ai/dsh-sdk with custom analysis tools. The check(files) method runs four checks in sequence:

Coverage : Fails with high severity if coverage < minCoverage Complexity : Flags files exceeding maxComplexity as medium severity

AI-Enhanced Check : Sends file contents to the agent with a prompt targeting logic errors, performance issues, error handling gaps, and untested edge cases; returns parsed QualityIssue array

Security Scan : Applies regex rules for eval( (high), innerHTML= (high), hardcoded passwords (critical), and more

The gate passes only when zero critical or high issues exist. Results include coverage percentage, maximum complexity, and all issues.

Automated Deployment Pipeline

Multi-Environment Deployment Strategy

An ASCII diagram illustrates the promotion flow: Feature branches auto-deploy to Dev; Develop branch auto-deploys to Staging; Main branch triggers manual blue-green deployment to Production.

Complete Deployment Pipeline

The .github/workflows/deploy.yaml workflow triggers on pushes to develop / main or manual dispatch with environment choice (dev, staging, production). It uses a setup job to map the trigger to an environment and namespace ( dsh-${environment}). The build job uses Docker Buildx with QEMU, logs into GHCR, extracts metadata (tags: SHA and branch ref), builds and pushes the image with GHA cache, and saves tags to image_tags.txt.

Environment-specific deployment jobs:

deploy-dev : Runs when environment=dev; uses azure/k8s-deploy@v4 to namespace dsh-dev; verifies with kubectl rollout status and kubectl get pods deploy-staging : Runs when environment=staging; first runs smoke tests ( sleep 30; curl -f https://staging-api.example.com/health), then deploys to dsh-staging, runs integration tests ( npm run test:integration -- --env=staging), and notifies Slack via slackapi/slack-github-action@v1 deploy-production : Runs when environment=production with concurrency group production-deploy (no cancel-in-progress). Steps: manual approval echo; pre-deployment checks (health check, DB migration npm run db:migrate -- --env production, backup ./scripts/backup-db.sh); blue-green deployment using kubectl set image on either dsh-app-blue or dsh-app-green based on steps.blue-green.outputs.active; waits for rollout with 300s timeout; switches traffic via kubectl patch service updating selector slot; runs smoke tests on /health and /api/v1/health/ready; cleans up inactive deployment on success; sends success Slack notification

Database Migration

src/db/migrate.ts

defines a MigrationManager using TypeORM DataSource (PostgreSQL). The migrate() method: initializes connection, ensures migration table, gets executed and pending migrations, runs each pending migration sequentially, logs count, and destroys connection. rollback(steps=1) reverses the last N migrations. An example migration CreateUsers1704067200000 creates a users table with UUID primary key, unique email, name, password, timestamps, and an email index; down drops the table.

GitOps Workflow

GitOps Architecture

Declarative configuration in Git repository ( apps/ for applications, infra/ for infrastructure) is continuously synced by ArgoCD/Flux to the Kubernetes cluster.

ArgoCD Application Configuration

argocd/application.yaml

defines an Application pointing to https://github.com/your-org/dsh-gitops.git at apps/dsh-app/overlays/production with Kustomize image override. Sync policy: automated with prune=true, selfHeal=true, allowEmpty=false, sync options CreateNamespace=true, PrunePropagationPolicy=foreground, PruneLast=true, retry limit 5 with exponential backoff (5s, factor 2, max 3m). Ignores replica differences on Deployments. Revision history limit 10.

Kustomize Configuration

Base ( apps/dsh-app/base/kustomization.yaml) includes deployment, service, configmap, HPA; sets common labels app=dsh-app, managed-by=kustomize, namespace dsh, and image ghcr.io/your-org/dsh-app:latest. Deployment requests 250m CPU/256Mi, limits 1000m/1Gi. Production overlay ( apps/dsh-app/overlays/production/kustomization.yaml) bases on ../../base, applies strategic merge patches for replicas (5) and resources (requests 500m/512Mi, limits 2000m/2Gi), sets image tag v1.0.0, adds label env=production.

Infrastructure as Code

Terraform Configuration

terraform/main.tf

requires Terraform >=1.5.0, AWS provider ~>5.0, Kubernetes provider ~>2.23, with S3 backend ( dsh-terraform-state, key dsh/production/terraform.tfstate, region us-east-1). Modules:

VPC : terraform-aws-modules/vpc/aws, CIDR 10.0.0.0/16, 3 AZs, private/public subnets, NAT gateways (multi-AZ)

EKS : terraform-aws-modules/eks/aws, cluster version 1.28, two managed node groups: application (t3.medium, 3-10 nodes, label node-type=application, taint node-type=application:NO_SCHEDULE) and system (t3.small, 2-4 nodes); IRSA enabled for AWS Load Balancer Controller

RDS : terraform-aws-modules/rds/aws, PostgreSQL 15.4, db.t3.medium, 100-500GB encrypted storage, 7-day backup retention, CloudWatch logs export

ElastiCache Redis : terraform-aws-modules/elasticache/aws, Redis 7.1, 2 cache.t3.medium nodes, at-rest and in-transit encryption, auth token enabled

Variable Configuration

variables.tf

defines aws_region (default us-east-1), environment (default production), domain_name (default example.com), db_password (sensitive), redis_auth_token (sensitive). terraform.tfvars.example shows non-sensitive defaults; sensitive values injected via CI/CD or secret manager.

Automated Operations Scenarios

Self-Healing

src/auto-heal/index.ts

implements AutoHealManager with a DSAgent and KubeClient. checkAndHeal(namespace) runs periodically: lists pods, filters unhealthy (status != Running, restartCount > 5, or phase == CrashLoopBackOff). For each, analyzeAndFix fetches last 100 log lines and pod events, sends to agent with a structured prompt requesting JSON diagnosis ( diagnosis, severity, suggestedAction, autoHealSafe). If autoHealSafe and severity != critical, performHeal executes the suggested action via a switch: restart (delete pod), scale_up (delete pod to trigger replica set), clear_pvc (delete associated PVCs then pod). Otherwise, sends Slack alert with diagnosis, severity, and pod details.

Cost Optimization

src/cost-optimizer/index.ts

defines CostOptimizer with DSAgent. analyze() gathers usage and billing data, prompts agent for recommendations (type: rightsizing/scheduling/storage/compute, resource, current, recommended, monthlySavings, impact). autoOptimize() only applies low-impact scheduling recommendations (e.g., auto-scaling rules, off-hours scale-down); other types are logged but skipped.

Monitoring and Alert Automation

Intelligent Alert Analysis

src/alert-analyzer/index.ts

implements AlertAnalyzer. analyze(alert) collects related historical alerts, metric trends, and recent changes, then prompts agent for root cause, impact, resolution steps, related alerts, and runbook link. autoRespond(alert, analysis): for critical alerts, sends urgent notification, executes auto-fix, creates incident; for others, sends notification. executeAutoFix matches alert name: OOMKilled → scale up pod memory; CPUThrottling → increase CPU limit; DiskPressure → cleanup logs.

Chapter Summary

DevOps Automation Panorama

A box diagram summarizes four stages: Quality Gates (code review → unit test → integration test → security scan → coverage check) → Automated Deployment (build image → push registry → deploy env → smoke test → traffic switch) → GitOps Operations (Git config → auto sync → state compare → drift alert → auto remediate) → Intelligent Operations (monitor alert → AI analysis → root cause diagnosis → auto fix → postmortem).

Key Toolchain

Quality: ESLint, TypeScript, Jest — code quality checks

CI/CD: GitHub Actions, ArgoCD — continuous integration/deployment

Container: Docker, Kubernetes — container orchestration

IaC: Terraform, Kustomize — infrastructure management

Monitoring: Prometheus, Grafana — observability

Logging: Loki, Elasticsearch — log management

Discussion Questions

How to balance automation and manual intervention boundaries?

How to ensure the automation process itself is reliable and high-quality?

What are the best use cases for AI in DevOps?

Homework Assignments

Required Tasks

Configure GitHub Actions CI pipeline

Implement quality gate checks

Configure ArgoCD GitOps

Write Kustomize configurations

Advanced Tasks

Implement self-healing capability

Configure cost optimization automation

Implement intelligent alert analysis

Deploy complete GitOps workflow

Next Chapter Preview

Chapter 17: Multi-Agent Collaboration Systems — covering multi-agent architecture design, inter-agent communication protocols, task decomposition and allocation, collaboration strategies and conflict resolution.