AI-Augmented Path to Production: Transforming Infrastructure Responsibility in the Age of Intelligent Pipelines

name: AI-Augmented Path to Production

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  id-token: write          # For OIDC-based cloud auth
  pull-requests: write     # For AI agent PR comments

jobs:
  # ─────────────────────────────────────────────
  # Stage 1: AI Change Analysis & Concurrency Plan
  # ─────────────────────────────────────────────
  ai-change-analysis:
    name: AI Change Analyzer
    runs-on: ubuntu-latest
    outputs:
      test_plan: ${{ steps.selector.outputs.test_plan }}
      concurrency_matrix: ${{ steps.concurrency.outputs.matrix }}
      risk_tier: ${{ steps.selector.outputs.risk_tier }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0   # Full history for diff analysis

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: pip

      - name: Install AI agent dependencies
        run: pip install openai python-dotenv tiktoken gitpython

      - name: Run AI test selector
        id: selector
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          BASE_BRANCH: ${{ github.base_ref || 'main' }}
        run: |
          python scripts/ai_test_selector.py \
            --base "$BASE_BRANCH" \
            --head "$GITHUB_SHA" \
            --output-format github-actions          

      - name: Compute dynamic concurrency matrix
        id: concurrency
        env:
          TELEMETRY_API: ${{ secrets.TELEMETRY_API_URL }}
          TELEMETRY_TOKEN: ${{ secrets.TELEMETRY_API_TOKEN }}
        run: |
          python scripts/compute_concurrency.py \
            --risk-tier "${{ steps.selector.outputs.risk_tier }}" \
            --queue-depth-api "$TELEMETRY_API/queue" \
            --output-format github-actions          

      - name: Post AI analysis summary to PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const testPlan = JSON.parse(`${{ steps.selector.outputs.test_plan }}`);
            const riskTier = "${{ steps.selector.outputs.risk_tier }}";
            const body = [
              "## 🤖 AI Pipeline Analysis",
              `**Risk Tier:** \`${riskTier}\``,
              `**Selected Test Suites:** ${testPlan.suites.join(', ')}`,
              `**Estimated Cycle Time:** ${testPlan.estimated_minutes} minutes`,
              `**Full Suite:** ${testPlan.full_suite ? '✅ Yes (high-risk change detected)' : '⚡ No (targeted selection)'}`,
              "",
              "### Reasoning",
              testPlan.reasoning
            ].join('\n');
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body
            });            

  # ─────────────────────────────────────────────
  # Stage 2: Dynamic Build with AI-Computed Concurrency
  # ─────────────────────────────────────────────
  build:
    name: Build (${{ matrix.module }})
    needs: ai-change-analysis
    runs-on: ubuntu-latest
    strategy:
      matrix: ${{ fromJson(needs.ai-change-analysis.outputs.concurrency_matrix) }}
      fail-fast: false
    steps:
      - uses: actions/checkout@v4

      - name: Build module
        run: |
          echo "Building module: ${{ matrix.module }}"
          make build MODULE=${{ matrix.module }}          

      - name: Upload build artifact
        uses: actions/upload-artifact@v4
        with:
          name: build-${{ matrix.module }}-${{ github.sha }}
          path: dist/${{ matrix.module }}/
          retention-days: 7

  # ─────────────────────────────────────────────
  # Stage 3: AI-Targeted Test Execution
  # ─────────────────────────────────────────────
  test:
    name: Test (${{ matrix.suite }})
    needs: [ai-change-analysis, build]
    runs-on: ubuntu-latest
    strategy:
      matrix:
        suite: ${{ fromJson(needs.ai-change-analysis.outputs.test_plan).suites }}
      fail-fast: false
    steps:
      - uses: actions/checkout@v4

      - name: Download build artifacts
        uses: actions/download-artifact@v4
        with:
          pattern: build-*-${{ github.sha }}
          merge-multiple: true

      - name: Run targeted test suite
        id: run-tests
        run: |
          make test SUITE=${{ matrix.suite }} \
            --report-file=results/${{ matrix.suite }}-results.json          

      - name: Upload test results
        uses: actions/upload-artifact@v4
        with:
          name: test-results-${{ matrix.suite }}-${{ github.sha }}
          path: results/

  # ─────────────────────────────────────────────
  # Stage 4: AI Artifact Promotion Evaluation
  # ─────────────────────────────────────────────
  artifact-promotion:
    name: AI Artifact Promotion Evaluator
    needs: [ai-change-analysis, test]
    runs-on: ubuntu-latest
    outputs:
      promotion_score: ${{ steps.evaluator.outputs.score }}
      promotion_decision: ${{ steps.evaluator.outputs.decision }}
      promoted_tag: ${{ steps.promote.outputs.tag }}
    steps:
      - uses: actions/checkout@v4

      - name: Download all test results
        uses: actions/download-artifact@v4
        with:
          pattern: test-results-*-${{ github.sha }}
          merge-multiple: true
          path: all-results/

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: pip

      - name: Install evaluator dependencies
        run: pip install openai requests prometheus-api-client

      - name: Run AI artifact evaluator
        id: evaluator
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          PROMETHEUS_URL: ${{ secrets.PROMETHEUS_URL }}
          ARTIFACT_SHA: ${{ github.sha }}
        run: |
          python scripts/ai_artifact_evaluator.py \
            --test-results-dir all-results/ \
            --production-metrics-url "$PROMETHEUS_URL" \
            --sha "$ARTIFACT_SHA" \
            --output-format github-actions          

      - name: Promote artifact (auto-promote tier)
        id: promote
        if: steps.evaluator.outputs.decision == 'auto-promote'
        env:
          REGISTRY: ${{ secrets.ARTIFACT_REGISTRY }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          TAG="${{ github.sha }}-promoted"
          docker tag app:${{ github.sha }} $REGISTRY/app:$TAG
          docker push $REGISTRY/app:$TAG
          echo "tag=$TAG" >> $GITHUB_OUTPUT          

      - name: Request human review (manual-review tier)
        if: steps.evaluator.outputs.decision == 'manual-review'
        uses: actions/github-script@v7
        with:
          script: |
            const score = "${{ steps.evaluator.outputs.promotion_score }}";
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## 🔍 AI Artifact Evaluator — Human Review Required\n\nPromotion score: **${score}**\n\nThe AI evaluator found signals that warrant human review before promoting this artifact to the staging registry. Please review the [evaluation report](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}) before approving.`
            });            

      - name: Block promotion (below threshold)
        if: steps.evaluator.outputs.decision == 'block'
        run: |
          echo "::error::Artifact promotion blocked. Score: ${{ steps.evaluator.outputs.promotion_score }}. See evaluation details in the run summary."
          exit 1          

  # ─────────────────────────────────────────────
  # Stage 5: AI-Driven Signal-Responsive Deployment
  # ─────────────────────────────────────────────
  deploy-staging:
    name: Deploy to Staging (Signal-Responsive)
    needs: artifact-promotion
    if: needs.artifact-promotion.outputs.promotion_decision != 'block'
    runs-on: ubuntu-latest
    environment:
      name: staging
      url: https://staging.example.com
    steps:
      - uses: actions/checkout@v4

      - name: Configure cloud credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_STAGING_ROLE_ARN }}
          aws-region: us-east-1

      - name: Deploy initial traffic slice (10%)
        id: initial-deploy
        run: |
          kubectl set image deployment/app \
            app=${{ secrets.ARTIFACT_REGISTRY }}/app:${{ needs.artifact-promotion.outputs.promoted_tag }} \
            --record
          kubectl annotate deployment/app \
            rollout.ai/traffic-percent="10" \
            rollout.ai/sha="${{ github.sha }}"          

      - name: Set up Python for deployment monitor
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: pip

      - name: Install deployment monitor dependencies
        run: pip install openai requests prometheus-api-client

      - name: AI deployment monitor — staged rollout
        id: monitor
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          PROMETHEUS_URL: ${{ secrets.PROMETHEUS_URL }}
          DEPLOYMENT_NAME: app
          DEPLOYMENT_SHA: ${{ github.sha }}
          ROLLOUT_SLICES: "10,25,50,100"
          SLICE_WAIT_SECONDS: "120"
          ERROR_RATE_THRESHOLD: "0.005"
          P99_LATENCY_THRESHOLD_MS: "500"
        run: |
          python scripts/ai_deployment_monitor.py \
            --deployment "$DEPLOYMENT_NAME" \
            --sha "$DEPLOYMENT_SHA" \
            --slices "$ROLLOUT_SLICES" \
            --wait "$SLICE_WAIT_SECONDS" \
            --error-threshold "$ERROR_RATE_THRESHOLD" \
            --latency-threshold "$P99_LATENCY_THRESHOLD_MS" \
            --output-format github-actions          

      - name: Rollback on deployment failure
        if: failure() && steps.monitor.outcome == 'failure'
        run: |
          kubectl rollout undo deployment/app
          echo "::error::AI deployment monitor triggered rollback. See monitor logs for signal details."          

  # ─────────────────────────────────────────────
  # Stage 6: Post-Deployment Telemetry Feedback
  # ─────────────────────────────────────────────
  telemetry-feedback:
    name: Production Telemetry Feedback Loop
    needs: [ai-change-analysis, test, artifact-promotion, deploy-staging]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: pip

      - name: Install feedback agent dependencies
        run: pip install openai requests prometheus-api-client mlflow

      - name: Download all artifacts for feedback analysis
        uses: actions/download-artifact@v4
        with:
          pattern: "*-${{ github.sha }}"
          merge-multiple: true
          path: run-artifacts/

      - name: Run pipeline feedback agent
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          MLFLOW_TRACKING_URI: ${{ secrets.MLFLOW_TRACKING_URI }}
          MLFLOW_TOKEN: ${{ secrets.MLFLOW_TOKEN }}
          PROMETHEUS_URL: ${{ secrets.PROMETHEUS_URL }}
          RUN_ID: ${{ github.run_id }}
          SHA: ${{ github.sha }}
          TEST_PLAN: ${{ needs.ai-change-analysis.outputs.test_plan }}
          PROMOTION_SCORE: ${{ needs.artifact-promotion.outputs.promotion_score }}
          PROMOTION_DECISION: ${{ needs.artifact-promotion.outputs.promotion_decision }}
          DEPLOY_OUTCOME: ${{ needs.deploy-staging.result }}
        run: |
          python scripts/telemetry_feedback_agent.py \
            --run-id "$RUN_ID" \
            --sha "$SHA" \
            --artifacts-dir run-artifacts/ \
            --log-to-mlflow          

#!/usr/bin/env python3
"""
AI Test Selector Agent
Analyzes the git diff and uses an LLM to produce a targeted test execution plan.
Outputs GitHub Actions compatible environment variables.
"""

import argparse
import json
import os
import subprocess
import sys
from pathlib import Path

import openai

SYSTEM_PROMPT = """
You are an AI test selection agent embedded in a CI/CD pipeline.
Your job is to analyze a code diff and select the minimal set of test suites
that should run to provide high confidence that no regressions have been introduced.

Available test suites:
- unit: Fast unit tests (< 2 minutes). Run for any change.
- integration: Service integration tests (< 10 minutes). Run when service interfaces change.
- contract: Consumer-driven contract tests (< 5 minutes). Run when API schemas change.
- e2e: End-to-end browser/API tests (< 20 minutes). Run for UI or critical path changes.
- performance: Load and benchmark tests (< 15 minutes). Run for algorithm or data layer changes.
- security: SAST and dependency scan (< 5 minutes). Run when dependencies or auth code changes.
- full: Complete test suite. Run for infrastructure, build system, or cross-cutting changes.

Risk tiers:
- low: Isolated, well-understood change. Targeted suite only.
- medium: Moderate scope. Targeted suite + integration.
- high: Cross-cutting or infrastructure change. Full suite required.

Return a JSON object with:
{
  "suites": ["suite1", "suite2"],
  "risk_tier": "low|medium|high",
  "estimated_minutes": <number>,
  "full_suite": true|false,
  "reasoning": "Brief explanation of selection rationale"
}
"""


def get_diff(base: str, head: str) -> str:
    """Get the git diff between base and head commits."""
    result = subprocess.run(
        ["git", "diff", "--name-status", f"{base}...{head}"],
        capture_output=True,
        text=True,
        check=True,
    )
    return result.stdout


def get_changed_files(base: str, head: str) -> list[str]:
    """Get list of changed file paths."""
    result = subprocess.run(
        ["git", "diff", "--name-only", f"{base}...{head}"],
        capture_output=True,
        text=True,
        check=True,
    )
    return [f.strip() for f in result.stdout.splitlines() if f.strip()]


def select_tests(diff_summary: str, changed_files: list[str]) -> dict:
    """Use LLM to select appropriate test suites."""
    client = openai.OpenAI(api_key=os.environ["OPENAI_API_KEY"])

    MAX_FILES_TO_ANALYZE = 50   # Cap to stay within context window
    MAX_DIFF_CHARS = 3000       # Approximate token budget for the diff

    files_context = "\n".join(changed_files[:MAX_FILES_TO_ANALYZE])
    user_message = f"""
Changed files:
{files_context}

Diff summary:
{diff_summary[:MAX_DIFF_CHARS]}

Select the appropriate test suites for this change.
"""

    response = client.chat.completions.create(
        model="gpt-4o",
        messages=[
            {"role": "system", "content": SYSTEM_PROMPT},
            {"role": "user", "content": user_message},
        ],
        response_format={"type": "json_object"},
        temperature=0.1,
    )

    return json.loads(response.choices[0].message.content)


def main():
    parser = argparse.ArgumentParser(description="AI Test Selector Agent")
    parser.add_argument("--base", required=True, help="Base branch or commit")
    parser.add_argument("--head", required=True, help="Head commit SHA")
    parser.add_argument("--output-format", default="stdout", choices=["stdout", "github-actions"])
    args = parser.parse_args()

    try:
        diff = get_diff(args.base, args.head)
        changed_files = get_changed_files(args.base, args.head)
    except subprocess.CalledProcessError as e:
        print(f"::error::Failed to get diff: {e.stderr.decode(errors='replace')}", file=sys.stderr)
        sys.exit(1)

    if not changed_files:
        # No changes detected — run unit tests as a baseline
        result = {
            "suites": ["unit"],
            "risk_tier": "low",
            "estimated_minutes": 2,
            "full_suite": False,
            "reasoning": "No file changes detected. Running unit tests as baseline.",
        }
    else:
        result = select_tests(diff, changed_files)

    if args.output_format == "github-actions":
        plan_json = json.dumps(result)
        with open(os.environ["GITHUB_OUTPUT"], "a") as f:
            f.write(f"test_plan={plan_json}\n")
            f.write(f"risk_tier={result['risk_tier']}\n")
    else:
        print(json.dumps(result, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
AI Artifact Promotion Evaluator
Combines test results, static analysis, and production telemetry to produce
a promotion confidence score and decision recommendation.
"""

import argparse
import json
import os
import sys
from pathlib import Path

import openai
import requests

SYSTEM_PROMPT = """
You are an AI artifact promotion evaluator embedded in a CI/CD pipeline.
Your job is to synthesize test results, static analysis findings, and production
telemetry to produce a promotion confidence score and recommendation.

Scoring thresholds:
- score >= 0.92: auto-promote (high confidence, proceed automatically)
- score 0.75-0.91: manual-review (moderate confidence, human review required)
- score < 0.75: block (low confidence, do not promote)

Evaluate the following signals:
1. Test pass rate and coverage delta
2. Performance benchmark delta (vs. established baseline)
3. Static analysis findings (severity and count)
4. Dependency vulnerability signals
5. Historical correlation: artifact characteristics vs. past incidents

Return a JSON object with:
{
  "score": <float 0.0-1.0>,
  "decision": "auto-promote|manual-review|block",
  "signals": {
    "test_pass_rate": <float>,
    "coverage_delta": <float>,
    "perf_regression": <bool>,
    "vuln_count_critical": <int>,
    "vuln_count_high": <int>
  },
  "reasoning": "Brief explanation of scoring rationale",
  "recommendations": ["action1", "action2"]
}
"""


def load_test_results(results_dir: Path) -> dict:
    """Aggregate test results from all suite result files."""
    aggregated = {"total": 0, "passed": 0, "failed": 0, "skipped": 0, "coverage": None}
    for result_file in results_dir.glob("*-results.json"):
        with open(result_file) as f:
            data = json.load(f)
        aggregated["total"] += data.get("total", 0)
        aggregated["passed"] += data.get("passed", 0)
        aggregated["failed"] += data.get("failed", 0)
        aggregated["skipped"] += data.get("skipped", 0)
        if data.get("coverage") is not None:
            aggregated["coverage"] = data["coverage"]
    return aggregated


def fetch_production_metrics(prometheus_url: str) -> dict:
    """Fetch current production health metrics from Prometheus."""
    queries = {
        "error_rate": 'sum(rate(http_requests_total{status=~"5.."}[5m])) / sum(rate(http_requests_total[5m]))',
        "p99_latency_ms": 'histogram_quantile(0.99, sum(rate(http_request_duration_ms_bucket[5m])) by (le)) * 1000',
        "apdex": 'sum(rate(http_requests_total{status="200",le="0.3"}[5m])) / sum(rate(http_requests_total[5m]))',
    }
    metrics = {}
    for name, query in queries.items():
        try:
            response = requests.get(
                f"{prometheus_url}/api/v1/query",
                params={"query": query},
                timeout=10,
            )
            data = response.json()
            if data["data"]["result"]:
                metrics[name] = float(data["data"]["result"][0]["value"][1])
            else:
                metrics[name] = None
        except Exception:
            metrics[name] = None
    return metrics


def evaluate_artifact(test_results: dict, prod_metrics: dict, sha: str) -> dict:
    """Use LLM to produce a promotion confidence score."""
    client = openai.OpenAI(api_key=os.environ["OPENAI_API_KEY"])

    user_message = f"""
Artifact SHA: {sha}

Test Results:
{json.dumps(test_results, indent=2)}

Current Production Metrics:
{json.dumps(prod_metrics, indent=2)}

Produce a promotion confidence score and decision recommendation.
"""

    response = client.chat.completions.create(
        model="gpt-4o",
        messages=[
            {"role": "system", "content": SYSTEM_PROMPT},
            {"role": "user", "content": user_message},
        ],
        response_format={"type": "json_object"},
        temperature=0.1,
    )

    return json.loads(response.choices[0].message.content)


def main():
    parser = argparse.ArgumentParser(description="AI Artifact Promotion Evaluator")
    parser.add_argument("--test-results-dir", required=True, type=Path)
    parser.add_argument("--production-metrics-url", required=True)
    parser.add_argument("--sha", required=True)
    parser.add_argument("--output-format", default="stdout", choices=["stdout", "github-actions"])
    args = parser.parse_args()

    test_results = load_test_results(args.test_results_dir)
    prod_metrics = fetch_production_metrics(args.production_metrics_url)
    evaluation = evaluate_artifact(test_results, prod_metrics, args.sha)

    if args.output_format == "github-actions":
        with open(os.environ["GITHUB_OUTPUT"], "a") as f:
            f.write(f"score={evaluation['score']}\n")
            f.write(f"decision={evaluation['decision']}\n")
        # Write full evaluation to step summary
        with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as f:
            f.write("## 🤖 AI Artifact Promotion Evaluation\n\n")
            f.write(f"**Score:** `{evaluation['score']:.3f}` → **{evaluation['decision'].upper()}**\n\n")
            f.write(f"**Reasoning:** {evaluation['reasoning']}\n\n")
            if evaluation.get("recommendations"):
                f.write("**Recommendations:**\n")
                for rec in evaluation["recommendations"]:
                    f.write(f"- {rec}\n")
    else:
        print(json.dumps(evaluation, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
AI Deployment Monitor Agent
Observes production signals during a staged rollout and autonomously decides
whether to proceed to the next traffic slice, pause for human review,
or trigger an automatic rollback.
"""

import argparse
import json
import os
import subprocess
import sys
import time
from dataclasses import dataclass, asdict

import openai
import requests

SYSTEM_PROMPT = """
You are an AI deployment monitor agent overseeing a staged production rollout.
At each traffic slice checkpoint, you receive production metrics from the last
observation window and must decide the next action.

Actions:
- proceed: Metrics are healthy. Advance to the next traffic slice.
- hold: Metrics show marginal degradation. Pause and alert for human review.
- rollback: Metrics show significant degradation. Trigger immediate rollback.

Return a JSON object with:
{
  "action": "proceed|hold|rollback",
  "confidence": <float 0.0-1.0>,
  "signals_observed": {
    "error_rate": <float>,
    "p99_latency_ms": <float>,
    "apdex": <float>
  },
  "reasoning": "Brief explanation of your decision"
}
"""


@dataclass
class DeploymentConfig:
    deployment: str
    sha: str
    slices: list[int]
    wait_seconds: int
    error_threshold: float
    latency_threshold_ms: float
    prometheus_url: str


def fetch_metrics(prometheus_url: str, deployment: str) -> dict:
    """Fetch metrics scoped to the current deployment."""
    queries = {
        "error_rate": f'sum(rate(http_requests_total{{deployment="{deployment}",status=~"5.."}}[2m])) / sum(rate(http_requests_total{{deployment="{deployment}"}}[2m]))',
        "p99_latency_ms": f'histogram_quantile(0.99, sum(rate(http_request_duration_ms_bucket{{deployment="{deployment}"}}[2m])) by (le)) * 1000',
        "apdex": f'sum(rate(http_requests_total{{deployment="{deployment}",status="200",le="0.3"}}[2m])) / sum(rate(http_requests_total{{deployment="{deployment}"}}[2m]))',
    }
    metrics = {}
    for name, query in queries.items():
        try:
            resp = requests.get(
                f"{prometheus_url}/api/v1/query",
                params={"query": query},
                timeout=10,
            )
            data = resp.json()
            metrics[name] = float(data["data"]["result"][0]["value"][1]) if data["data"]["result"] else None
        except Exception:
            metrics[name] = None
    return metrics


def ai_evaluate_signals(metrics: dict, config: DeploymentConfig, current_slice: int) -> dict:
    """Use LLM to evaluate deployment health and decide next action."""
    client = openai.OpenAI(api_key=os.environ["OPENAI_API_KEY"])

    user_message = f"""
Deployment: {config.deployment} (SHA: {config.sha})
Current traffic slice: {current_slice}%
Error rate threshold: {config.error_threshold}
P99 latency threshold: {config.latency_threshold_ms}ms

Observed metrics (last 2 minutes):
{json.dumps(metrics, indent=2)}

Should I proceed to the next slice, hold for human review, or rollback?
"""

    response = client.chat.completions.create(
        model="gpt-4o",
        messages=[
            {"role": "system", "content": SYSTEM_PROMPT},
            {"role": "user", "content": user_message},
        ],
        response_format={"type": "json_object"},
        temperature=0.05,
    )

    return json.loads(response.choices[0].message.content)


def set_traffic_slice(deployment: str, percent: int) -> None:
    """Adjust the traffic weight for the canary deployment."""
    subprocess.run(
        [
            "kubectl", "annotate", "deployment", deployment,
            f"rollout.ai/traffic-percent={percent}",
            "--overwrite",
        ],
        check=True,
    )
    print(f"  Traffic slice set to {percent}%")


def main():
    parser = argparse.ArgumentParser(description="AI Deployment Monitor")
    parser.add_argument("--deployment", required=True)
    parser.add_argument("--sha", required=True)
    parser.add_argument("--slices", required=True, help="Comma-separated traffic percentages")
    parser.add_argument("--wait", type=int, default=120, help="Seconds to wait between slice evaluations")
    parser.add_argument("--error-threshold", type=float, default=0.005)
    parser.add_argument("--latency-threshold", type=float, default=500.0)
    parser.add_argument("--output-format", default="stdout", choices=["stdout", "github-actions"])
    args = parser.parse_args()

    config = DeploymentConfig(
        deployment=args.deployment,
        sha=args.sha,
        slices=[int(s.strip()) for s in args.slices.split(",")],
        wait_seconds=args.wait,
        error_threshold=args.error_threshold,
        latency_threshold_ms=args.latency_threshold,
        prometheus_url=os.environ["PROMETHEUS_URL"],
    )

    rollout_log = []

    for slice_pct in config.slices:
        print(f"\n── Advancing to {slice_pct}% traffic slice ──")
        set_traffic_slice(config.deployment, slice_pct)

        print(f"  Waiting {config.wait_seconds}s for signal stabilization...")
        time.sleep(config.wait_seconds)

        metrics = fetch_metrics(config.prometheus_url, config.deployment)
        decision = ai_evaluate_signals(metrics, config, slice_pct)

        rollout_log.append({
            "slice_pct": slice_pct,
            "metrics": metrics,
            "decision": decision,
        })

        print(f"  AI Decision: {decision['action'].upper()} (confidence: {decision['confidence']:.2f})")
        print(f"  Reasoning: {decision['reasoning']}")

        if decision["action"] == "rollback":
            print("::error::AI deployment monitor triggered rollback.")
            if args.output_format == "github-actions":
                with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as f:
                    f.write("## 🚨 AI Deployment Monitor — ROLLBACK TRIGGERED\n\n")
                    f.write(f"**Slice:** {slice_pct}%\n\n")
                    f.write(f"**Reasoning:** {decision['reasoning']}\n\n")
                    f.write("**Signals Observed:**\n```json\n")
                    f.write(json.dumps(metrics, indent=2))
                    f.write("\n```\n")
            sys.exit(1)

        elif decision["action"] == "hold":
            print("::warning::AI deployment monitor paused rollout. Human review required.")
            if args.output_format == "github-actions":
                with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as f:
                    f.write("## ⏸️ AI Deployment Monitor — HOLD (Human Review Required)\n\n")
                    f.write(f"**Slice:** {slice_pct}%\n\n")
                    f.write(f"**Reasoning:** {decision['reasoning']}\n\n")
            sys.exit(1)

    # All slices completed successfully
    print("\n✅ Rollout completed successfully across all traffic slices.")
    if args.output_format == "github-actions":
        with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as f:
            f.write("## ✅ AI Deployment Monitor — Rollout Complete\n\n")
            f.write(f"All {len(config.slices)} traffic slices completed without signal degradation.\n\n")
            f.write("**Rollout Log:**\n```json\n")
            f.write(json.dumps(rollout_log, indent=2))
            f.write("\n```\n")


if __name__ == "__main__":
    main()