# CI/CD

Declarative GitOps continuous delivery tool for Kubernetes.

Argo CD is the most popular GitOps continuous delivery tool for Kubernetes. It continuously monitors Git repositories and automatically syncs application state to match the desired configuration. A CNCF graduated project used by thousands of organizations for deploying to Kubernetes clusters.

Run GitHub Actions on faster bare-metal runners with lower Ubuntu per-minute pricing

Blacksmith is a drop-in replacement for GitHub-hosted runners that executes Actions on bare-metal gaming CPUs and source-shaped cache infrastructure. Migration requires a one-line YAML change. Features include colocated warm caches, persistent Docker layer caching on NVMe, CI observability with log search, and Firecracker microVM isolation. SOC 2 Type 2 certified, with Ubuntu x64 pricing at $0.004/min and 3,000 free minutes/month.

Hybrid CI/CD platform with self-hosted agents and cloud orchestration

Buildkite is a hybrid CI/CD platform that separates orchestration from execution. Its SaaS control plane manages pipelines, UI, authentication, and coordination while agents run builds on self-hosted or hosted infrastructure. Current pricing lists Personal at $0, Pro at $30 USD per active user/mo, P95 billing for self-hosted agents, Test Engine, Package Registries, and hosted Mac/Linux agent options.

Merge queue, CI insights, flaky-test controls, and stacked pull requests for GitHub teams

Mergify is a pull request automation platform that keeps main branches green with merge queue batching, merge protections, CI Insights, flaky-test detection, and stacked pull requests. Its Stacks workflow turns commits on one local branch into focused PR chains, helping teams review large AI-generated or feature-heavy changes without losing queue safety.

Fast open-source SAST with custom rules

Semgrep is an AppSec platform with a widely used open-source engine for readable code rules plus commercial SAST, supply-chain and secrets workflows. Current product positioning emphasizes AI-assisted detection, triage and remediation, CI/pull-request integration and managed governance for security teams.

Code quality and security analysis platform

SonarQube is an open-source code quality and security platform with 10K+ GitHub stars that inspects code for bugs, vulnerabilities, code smells, and security hotspots. It enforces quality gates in CI/CD pipelines, supports 30+ languages in Team plans and 40+ in Enterprise, and remains the industry standard for static code quality management.

Unified code-to-cloud security platform for developers

Aikido Security is an all-in-one AppSec platform unifying SAST, DAST, SCA, CSPM, secrets detection, container scanning, IaC analysis, and runtime protection in a single developer-friendly dashboard. Cuts false positive noise by 95% through reachability analysis that evaluates vulnerabilities in actual deployment context. Features AI AutoFix for one-click remediation, CI/CD gating, and AI-powered pentesting agents. Trusted by 50,000+ organizations. Supports 50+ programming languages.

Developer-first security platform

Snyk is the leading developer security platform providing continuous scanning for vulnerabilities in code (SAST), open-source dependencies (SCA), container images, and infrastructure as code. Integrates directly into IDEs, Git repositories, CI/CD pipelines, and container registries. Features AI-powered fix suggestions, license compliance checking, and real-time vulnerability database. Free for individual developers with paid plans for teams. Supports 30+ programming languages.

Secret scanning across Git history and cloud storage

TruffleHog by Truffle Security scans for high-entropy strings and secrets across GitHub history, S3 buckets, and other data stores with 26.7K+ GitHub stars. It goes beyond simple pattern matching by verifying whether discovered credentials are actually active and valid, significantly reducing false positives and helping teams prioritize remediation of truly exposed secrets.

Automate your workflow from GitHub

GitHub's built-in CI/CD and workflow automation platform that runs directly in your repository. Define workflows in YAML triggered by Git events (push, PR, release), schedules, or manual dispatch. Massive marketplace of 20,000+ community-maintained actions for testing, building, deploying, and automating tasks. Supports matrix builds, caching, secrets, environments with approval gates, and self-hosted runners. Free for public repos with generous minutes for private repos.

Secrets security and non-human identity governance across code, CI/CD, endpoints, CLI/IDE/API, and MCP workflows.

GitGuardian is a secrets security and non-human identity governance platform for finding, triaging, and remediating leaked credentials across repositories, CI/CD, developer endpoints, CLI/IDE workflows, APIs, and MCP-connected environments. It combines managed incident workflow with developer-side prevention, Endpoint Protection, and broader credential lifecycle governance.

Open-source secret detection for Git repositories

Gitleaks is an open-source secret scanner with 27K+ GitHub stars that detects hardcoded passwords, API keys, tokens, and private keys in Git repositories, files, directories, and full Git history. It integrates via GitHub Actions, pre-commit hooks, CI/CD pipelines, and single-binary local scans.

Slack-native incident management with AI SRE agent

Incident.io is a Slack- and Microsoft Teams-native incident management platform with AI SRE investigation, on-call scheduling, status pages, and post-incident learning in one product. Vendor case studies cite Buffer reducing critical incidents by 70% and Favor reducing MTTR by 37%. It integrates with PagerDuty, Datadog, GitHub, Jira, and 100+ tools for incident response and operational workflows.

Managed SonarQube Cloud code quality and security analysis for CI/CD workflows.

SonarQube Cloud, still commonly associated with the SonarCloud name, is SonarSource’s managed code quality and security SaaS for GitHub, GitLab, Bitbucket, and Azure DevOps. It scans pull requests for bugs, vulnerabilities, security hotspots, code smells, duplication, and coverage regressions, then enforces Quality Gates without running SonarQube Server. Current Sonar docs frame the cloud service around 40+ languages, with Team from $32 monthly and Enterprise custom.

Telemetry-aware AI code reviewer that checks how pull requests may affect real services.

Baz is an AI code-review platform focused on production-aware pull requests. Instead of only reading the diff, Baz connects code changes to application telemetry so reviewers can understand what endpoints, services, and runtime behavior may be affected. That makes it a useful complement to existing AI PR bots when the question is not just whether a change looks correct, but whether it could break a live system.

All-in-one AI code review, security, and quality

CodeAnt AI combines AI code review, SAST, secret detection, IaC security, policy enforcement, compliance dashboards, and agentic pentesting in one platform for engineering teams that want code quality and security checks before production.

Autonomous Java unit test generation in CI

Diffblue Testing Agent orchestrates verified regression unit test generation for Java and Python projects through existing AI coding platforms such as GitHub Copilot CLI and Claude Code. It measures baseline coverage, generates tests, verifies that they compile and pass, and charges for net new coverage lines added rather than per seat or API call.

Microsoft’s pytest-native red teaming framework for turning AI agent safety findings into CI tests.

RAMPART is an open-source Microsoft framework for safety and security testing of agentic AI applications. It brings red-team findings into a pytest-native workflow so teams can turn prompt injection, unsafe tool use, and behavioral boundary failures into repeatable regression tests. The strongest aicoolies angle is developer workflow: RAMPART makes agent safety part of CI/CD instead of a one-off security review.

Kubernetes-native testing for coding agents

Signadot is a Kubernetes-native validation platform that lets developers test agent-generated code in isolated preview environments mimicking production. It creates lightweight sandboxes within existing clusters where code changes can be validated against real microservice dependencies, ensuring that AI-generated modifications do not break cross-service interactions before merging to main.

Meta's open-source LLM security suite with Llama Guard and CodeShield

PurpleLlama is Meta's open-source suite of tools for evaluating and improving LLM safety. It includes Llama Guard models for input/output content safety classification, LlamaFirewall for multi-layer defense, CodeShield for insecure code detection, and CyberSecEval benchmarks for measuring LLM security. Llama Guard 4 supports multimodal safety across text and images. 4,100+ GitHub stars, backed by Meta AI with 44+ contributors.

Cross-browser testing in the cloud

Cloud testing platform with access to 3,500+ real browser combinations and 30,000+ real devices for automated cross-browser testing. Integrates with Selenium, Cypress, and Playwright. Offers visual testing, accessibility checks, and Percy integration for screenshot comparison, enabling teams to catch UI regressions across every browser and device combination without maintaining local infrastructure.

Code health analysis and technical debt quality gates

CodeScene analyzes code health, technical debt, and delivery risks by examining code patterns and change frequency, then integrates as CI/CD quality gates on pull requests. It scales AI-assisted development safely by measuring whether generated code maintains architectural integrity, with on-premises deployment options and pricing that starts free for open-source projects.

Unified API, performance, and contract testing DSL

Karate is an open-source testing framework that unifies API testing, performance testing, UI automation, and contract testing in a single BDD-style DSL. Write tests in plain Gherkin-like syntax without any Java knowledge. Built-in assertions, data-driven testing, parallel execution, and HTML reports. 8,900+ GitHub stars, MIT licensed. Mature, actively maintained project with commercial support options for comprehensive API quality assurance.

Open-source AI-powered PR review with slash commands

PR-Agent by Qodo is the most widely adopted open-source AI code review tool with 11,500+ GitHub stars and 207 contributors. It provides automated PR description generation, intelligent line-by-line code review, and actionable improvement suggestions through intuitive slash commands like /describe, /review, and /improve, integrating natively with GitHub Actions, GitLab CI, Bitbucket, and Azure DevOps.

AI test generation from production traffic

Tusk is a Y Combinator W24-backed AI testing platform that converts real production traffic into unit and API tests, catching regressions in 43% of PRs. Its Drift SDK records live API traces with just 10 lines of code, then AI generates executable test cases covering thousands of edge cases from actual user behavior, auto-maintaining suites as application logic evolves without manual script writing.

Continuous integration and delivery

Cloud CI/CD platform known for speed and Docker-first workflows. Offers parallelism, intelligent caching, and orbs (reusable configuration packages) for common tasks. Used by Spotify, Samsung, and Ford. Strong at complex build pipelines with conditional logic, matrix builds, and granular resource allocation that help large teams optimize their build times.

AI coding agent for code review and bug fixing

Ellipsis is a YC W24-backed AI coding teammate for GitHub repositories that reviews pull requests, catches bugs, writes summaries, answers codebase questions, and generates tested fixes from comments or issues. It pairs automated review with code generation, $20/dev/month seat pricing, SOC 2 Type 1 controls, and no source-code persistence between workflows.

Visual regression testing for CI/CD pipelines

Argos CI is a visual regression testing platform that automatically catches unintended UI changes in CI/CD pipelines. It integrates with Playwright, Cypress, Storybook, and Puppeteer, featuring a stabilization engine that filters flaky pixel differences from genuine regressions. Used by teams at Meta and MUI for frontend quality gates.

Developer productivity platform with merge queues and flaky test detection

Aviator is a developer productivity platform combining merge queues, stacked PRs, automated code review, and flaky test management. Its merge queue prevents broken main branches by testing PRs in order before merging. Flaky test detection identifies unreliable tests causing CI failures. Founded by ex-Google engineers who built internal developer tools at scale. YC-backed with $2.3M seed from Elad Gil. Used by Bosch, Benchling, and Lightspeed.

Ephemeral preview environments for every pull request

Bunnyshell automates the creation of full-stack ephemeral environments that spin up for every pull request and tear down when merged. Each environment is a complete replica of the application stack including databases, APIs, and frontend services. Integrates with GitHub, GitLab, and Bitbucket to provide shareable preview URLs for testing, QA, and stakeholder review.

Database CI/CD and DevSecOps platform at scale

Bytebase is an open-source database DevSecOps platform that automates schema migrations, enforces SQL standards across 200+ lint rules, and provides fine-grained access control with dynamic data masking. Teams use it for GitOps-based database change management, SQL review, and compliance across PostgreSQL, MySQL, MongoDB, Snowflake, Oracle, SQL Server, and 20+ other databases. Available as self-hosted Docker or Kubernetes deployment, or as a managed cloud service.

Multi-agent framework for finding scaling laws of agents

CAMEL-AI is an open-source multi-agent framework with 16,500+ GitHub stars, built by a research community of over 100 researchers focused on finding the scaling laws of agents. It supports role-playing agent societies, synthetic data generation pipelines, large-scale social simulations with up to 1M agents via the OASIS platform, and real-world task automation through the OWL project accepted at NeurIPS 2025. CAMEL works with OpenAI, Anthropic, Gemini, Mistral, and local models.

Enterprise application security testing platform

Checkmarx is an enterprise application security testing platform providing SAST, SCA, DAST, API security, IaC scanning, and container security in a unified solution. Features AI-powered vulnerability detection, automated remediation guidance, and correlation across scan types to prioritize the most critical risks. Supports 30+ programming languages with deep framework-specific rules. Integrates with all major IDEs, Git platforms, and CI/CD pipelines. Used by Fortune 500 companies globally.

Anthropic's official GitHub Action that runs Claude Code in CI

Anthropic's official GitHub Action that brings Claude Code into GitHub PRs and issues — answering questions, reviewing code, and implementing changes when triggered by @claude mentions or workflow automation. This is the CI/CD Action, not the terminal agent.

AI-powered SAST for PR-time security analysis

CodeThreat provides pull request-time security analysis covering SAST, dependency vulnerability checks, and infrastructure-as-code risk review. Highly rated for its seamless GitHub integration, it catches security issues introduced by both human and AI-generated code before they reach production, with particular strength in identifying vulnerabilities from rapid vibe coding workflows.

Container-based CI/CD automation system

Concourse is an open-source CI/CD system built on composable primitives: resources for external artifacts, tasks for containerized work units, and jobs for orchestration. All pipelines are declarative YAML with version control, every task runs in an isolated container, and stateless workers enable horizontal scaling. Deployable via BOSH, Helm, Docker Compose, or standalone binary across any infrastructure.

Parallel test orchestration for Playwright and Cypress

Currents is a test orchestration platform that parallelizes Playwright and Cypress test suites across multiple CI machines for faster feedback. It provides intelligent test splitting, re-run strategies for flaky tests, detailed analytics dashboards, and native Playwright chunking. Achieves up to 50% test suite speed improvements through optimized distribution and parallel execution management.

Programmable CI/CD engine that runs your pipelines in containers

Programmable CI/CD engine that replaces shell scripts and YAML with a typed API across 8 languages (Go, Python, TypeScript, Java, Rust, etc.). Dagger runs every pipeline step in containers for portable, locally-debuggable, cacheable builds that work identically on any CI platform. Includes GraphQL query optimization for parallelization, OpenTelemetry observability, and Dagger Cloud for managed compute.

Containerized sandboxes for AI coding agents

Dagger Container Use provides isolated container environments for AI coding agents, enabling multiple agents to work in separate sandboxed branches simultaneously. Built by the Dagger team, it ensures reproducibility and safety for autonomous code execution by giving each agent its own containerized workspace with full toolchain access.

Managed Docker build acceleration with up to 40x faster builds

Depot provides managed infrastructure for dramatically faster Docker image builds. It uses persistent build caches, native Intel and ARM builders, and optimized build scheduling to achieve up to 40x faster builds compared to standard Docker build workflows. Drop-in replacement for docker build that requires no Dockerfile changes. Used by major engineering teams to cut CI/CD pipeline times.

Open-source IaC orchestration that runs Terraform plans and applies from pull request comments

Digger is an open-source infrastructure-as-code orchestration tool for running Terraform and OpenTofu plan/apply workflows from pull request comments. It uses the team’s existing VCS and CI runners instead of adding a separate runner fleet, supports GitHub, GitLab, and Azure DevOps style workflows, and stores PR-level locks and plan cache in the user’s cloud account.

Your CI/CD scripts as code. Consistent, reproducible builds.

Build automation framework that combines Dockerfile and Makefile syntax for repeatable, containerized builds. Earthly runs every step in a container so builds produce identical results on dev laptops and CI, augmenting Make/Gradle/npm/cargo with cross-language reproducibility. Features parallel target execution, layer caching, multi-platform builds, and references across Earthfiles or repositories.

Dependency lifecycle management and risk reduction

Endor Labs is a dependency management platform that goes beyond vulnerability scanning to assess the overall risk of open-source dependencies. Evaluates maintainer activity, code quality, popularity trends, licensing, and operational risk alongside CVEs. Features reachability analysis to determine if vulnerabilities are actually exploitable in your codebase. Provides dependency selection guidance for choosing safer alternatives. Reduces alert fatigue by prioritizing truly risky dependencies.

Code management platform for AI coding agents

Entire is an AI-native code management platform designed for teams managing fleets of AI coding agents. Founded by former GitHub CEO Thomas Dohmke, it records the reasoning and instructions behind AI-generated code alongside the code itself, making agent-written software easier to review, audit, and maintain. Launches with Checkpoints, an open-source CLI tool that logs prompts and token usage for Claude Code and Google Gemini CLI, with more agent integrations planned.

Cloud native runtime security for Kubernetes

Falco is a CNCF graduated open-source runtime security tool that detects unexpected behavior and threats across containers, Kubernetes, and cloud workloads in real time. Originally created by Sysdig, Falco monitors Linux kernel syscalls using eBPF and applies customizable detection rules to alert on malicious activity like container escapes, cryptojacking, unauthorized file access, and anomalous network connections. It supports 50+ alert output channels including SIEM integration.

Free open-source local AWS emulator as a drop-in LocalStack replacement

Floci is a free open-source AWS emulator designed as a lightweight drop-in replacement for LocalStack Community Edition. It runs on port 4566 with the same endpoint conventions, supporting S3, SQS, DynamoDB, RDS, ElastiCache, API Gateway, Cognito, IAM, and twenty-plus other services. The Docker image is ninety megabytes versus LocalStack's one gigabyte and starts in twenty-four milliseconds.

Continuous security scanning with AI and human expertise

Fluid Attacks integrates continuous vulnerability scanning into the SDLC by combining AI automation with human security expertise to verify critical flaws. The hybrid approach ensures that automated findings are validated by security researchers before reaching developers, reducing false positive noise while maintaining coverage across SAST, DAST, SCA, and infrastructure-as-code security scanning.

GitOps toolkit for Kubernetes — continuous delivery the cloud-native way.

Flux is a CNCF graduated GitOps tool for keeping Kubernetes clusters in sync with configuration sources like Git repositories, Helm charts, and OCI artifacts. Lightweight, composable, and designed to work with existing tools. The primary alternative to ArgoCD in the GitOps space.