# Handler: generate

Create new CI/CD pipeline from project analysis.

## Process

1. **Detect context**:
   - Read `.ai-engineering/manifest.yml` field `providers.stacks` for the project's active stacks.
   - Read `manifest.yml` for VCS provider, Sonar config.
   - Read `cicd.standards_url` from `.ai-engineering/manifest.yml`. **When the field is set** (non-null, non-empty string): call the `WebFetch` tool with that URL and a focused prompt ("Extract CI/CD requirements, mandatory checks, security gates, SHA pinning policy, timeout policy, OIDC requirements"); use the returned text as the authoritative baseline and cite the URL in the generated workflow comment. **When the field is null or unset**: generate using AI best practices documented in the Shared Rules section of `SKILL.md`. Either way, log the chosen path in the validation report.

2. **Select provider**:
   - `--provider github`: GitHub Actions (`.github/workflows/`).
   - `--provider azure`: Azure Pipelines (`.azure-pipelines/`).
   - Default: detect from `git remote get-url origin`.

3. **Generate pipelines** -- produce workflow files directly:

   | Provider | Files | Content |
   |----------|-------|---------|
   | GitHub Actions | `ci.yml`, `ai-pr-review.yml` | Multi-job: lint, test, security, gate. Concurrency, timeouts, SHA pinning. |
   | Azure Pipelines | `ci.yml`, `ai-pr-review.yml` | Single-stage: stack checks, security. Triggers and pool config. |

4. **Apply stack checks**:
   - Python: `ruff check`, `ruff format --check`, `pytest`, `uv run python -m ai_engineering.verify.tls_pip_audit`, `ty check`.
   - .NET: `dotnet build`, `dotnet test`, `dotnet format --verify-no-changes`.
   - Node: `eslint`, `vitest`, `npm audit`.
   - Rust: `cargo check`, `cargo clippy`, `cargo test`, `cargo audit`.

5. **Apply security**:
   - SHA pin all third-party actions (resolve latest SHA for each action).
   - Add `gitleaks` and `semgrep` jobs.
   - Add `uv run python -m ai_engineering.verify.tls_pip_audit` / `npm audit` / `cargo audit` per stack.
   - Configure OIDC for deployment steps where possible.

6. **Apply infrastructure**:
   - `timeout-minutes` on every job.
   - Concurrency group by branch: `group: ${{ github.ref }}`.
   - `dependabot.yml` for automated dependency updates.

7. **Validate** -- `actionlint` on generated files. Fix any issues.

## Output

- Generated workflow files.
- `dependabot.yml` configuration.
- Validation report.
- Branch Protection recommendations.
