| CI | PRs to main | Lint, type check, and test |
| CodeQL | Push to main, PRs, weekly schedule | Static security analysis |
| Deploy KeeWeb | Push to main, workflow_dispatch | Build and deploy KeeWeb (path-filtered) |
| Deploy CLIProxy | Push to main, workflow_dispatch | Deploy CLIProxyAPI (path-filtered) |
| Deploy Gateway | Push to main, workflow_dispatch | Deploy gateway stack (path-filtered) |
| Deploy Umami | Push to main, workflow_dispatch | Deploy Umami analytics stack (path-filtered) |
| Deploy Dashboard | Push to main, workflow_dispatch | Build dashboard image to GHCR and deploy (path-filtered) |
| Deploy VPN | Push to main, workflow_dispatch | Deploy WireGuard VPN box (path-filtered) |
| Deploy Broker | Push to main, workflow_dispatch | Deploy the credential broker stack (path-filtered) |
| Deploy | Push to main, workflow_dispatch | Router that path-filters changes and dispatches the per-app deploy workflows |
| Release | Push to main | Version and publish @marcusrbrown/infra via Changesets |
| Release Alert | Release workflow completion, workflow_dispatch | Open a GitHub issue when Release fails |
| Renovate | Schedule, issue/PR edits, post-deploy | Automated dependency updates |
| Renovate Changesets | Renovate PRs | Auto-create changeset files for dependency updates |
| Prune Packages | workflow_dispatch | Delete untagged GHCR package versions (dry-run unless apply: true) |
| Fro Bot | PRs, @mentions, daily schedule, workflow_dispatch | AI code review and autohealing |
| CLIProxy Anthropic auth monitor | Nominal 15-minute schedule, workflow_dispatch | Probe Anthropic auth and reconcile GitHub issue/Discord transition alerts |
| Copilot Setup Steps | workflow_dispatch, changes to workflow file | Prepare environment for Copilot coding agent |
| Scorecard | Weekly, push to main | OpenSSF security analysis |
| Update Repo Settings | Daily, push to main | Sync repo settings from .github/settings.yml |