PR back to Optum

.dockerignore

@@ -0,0 +1,11 @@
+.git
+.github
+spec
+docs
+*.md
+.rubocop.yml
+.rspec
+tmp
+log
+.dockerignore
+Dockerfile

.github/CODEOWNERS

@@ -0,0 +1,12 @@
+# Auto-generated from team-config.yml
+# Team: core
+#
+# To apply: scripts/apply-codeowners.sh LegionIO
+
+* @LegionIO/maintainers @LegionIO/core
+
+# Path-specific reviewers
+lib/legion/cli/chat/ @LegionIO/ai
+lib/legion/api/ @LegionIO/core
+lib/legion/extensions/ @LegionIO/extensions
+.github/ @LegionIO/infra

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: bundler
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - "type:dependencies"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - "type:dependencies"

.github/workflow-templates/eval-gate.yml

@@ -0,0 +1,118 @@
+# .github/workflow-templates/eval-gate.yml
+#
+# Eval gate workflow template for LegionIO CI/CD pipelines.
+# Copy this file to .github/workflows/eval-gate.yml in your repo and adjust the
+# env vars to match your dataset and threshold requirements.
+#
+# Required secrets:
+#   LEGIONIO_BOOTSTRAP_CONFIG  (base64-encoded bootstrap JSON, or omit for defaults)
+#
+# Usage:
+#   - Trigger manually (workflow_dispatch) or on push/PR targeting main
+#   - Job exits 0 if avg_score >= threshold, exits 1 and fails the pipeline if below
+
+name: Eval Gate
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      dataset:
+        description: 'Dataset name to evaluate'
+        required: true
+        default: 'default'
+      threshold:
+        description: 'Pass/fail threshold (0.0 - 1.0)'
+        required: false
+        default: '0.8'
+      evaluator:
+        description: 'Evaluator name (leave blank for first builtin template)'
+        required: false
+        default: ''
+
+env:
+  DATASET:   ${{ github.event.inputs.dataset   || 'default' }}
+  THRESHOLD: ${{ github.event.inputs.threshold || '0.8' }}
+  EVALUATOR: ${{ github.event.inputs.evaluator || '' }}
+
+jobs:
+  eval-gate:
+    name: Eval Gate (${{ env.DATASET }} @ ${{ env.THRESHOLD }})
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.4'
+          bundler-cache: true
+
+      - name: Install Legion
+        run: gem install legionio --no-document
+
+      - name: Bootstrap config (optional)
+        if: ${{ secrets.LEGIONIO_BOOTSTRAP_CONFIG != '' }}
+        env:
+          LEGIONIO_BOOTSTRAP_CONFIG: ${{ secrets.LEGIONIO_BOOTSTRAP_CONFIG }}
+        run: echo "Bootstrap config present"
+
+      - name: Run eval gate
+        id: eval
+        env:
+          LEGIONIO_BOOTSTRAP_CONFIG: ${{ secrets.LEGIONIO_BOOTSTRAP_CONFIG }}
+        run: |
+          EVAL_ARGS="--dataset $DATASET --threshold $THRESHOLD --exit-code --json"
+          if [ -n "$EVALUATOR" ]; then
+            EVAL_ARGS="$EVAL_ARGS --evaluator $EVALUATOR"
+          fi
+          legion eval run $EVAL_ARGS | tee eval-report.json
+
+      - name: Upload eval report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: eval-report-${{ github.run_number }}
+          path: eval-report.json
+          retention-days: 30
+
+      - name: Annotate PR with eval results
+        if: github.event_name == 'pull_request' && always()
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            let report;
+            try {
+              report = JSON.parse(fs.readFileSync('eval-report.json', 'utf8'));
+            } catch (e) {
+              console.log('Could not parse eval report:', e.message);
+              return;
+            }
+            const gate   = report.passed ? 'PASSED' : 'FAILED';
+            const score  = (report.avg_score || 0).toFixed(3);
+            const thresh = report.threshold || 0;
+            const body   = [
+              `## Eval Gate: ${gate}`,
+              '',
+              `| Metric | Value |`,
+              `|--------|-------|`,
+              `| Dataset | \`${report.dataset}\` |`,
+              `| Evaluator | \`${report.evaluator}\` |`,
+              `| Avg Score | ${score} |`,
+              `| Threshold | ${thresh} |`,
+              `| Total Rows | ${report.summary?.total ?? 'N/A'} |`,
+              `| Passed | ${report.summary?.passed ?? 'N/A'} |`,
+              `| Failed | ${report.summary?.failed ?? 'N/A'} |`,
+            ].join('\n');
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner:        context.repo.owner,
+              repo:         context.repo.repo,
+              body:         body,
+            });

.github/workflows/ci-cd.yml

@@ -0,0 +1,13 @@
+name: CI/CD
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  helm-lint:
+    name: Helm Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: azure/setup-helm@v3
+      - run: helm lint deploy/helm/legion

.github/workflows/ci.yml

@@ -0,0 +1,76 @@
+name: CI
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '0 9 * * 1'
+
+jobs:
+  ci:
+    uses: LegionIO/.github/.github/workflows/ci.yml@main
+    with:
+      needs-rabbitmq: true
+
+  security:
+    uses: LegionIO/.github/.github/workflows/security-scan.yml@main
+    with:
+      brakeman-enabled: false
+
+  version-changelog:
+    uses: LegionIO/.github/.github/workflows/version-changelog.yml@main
+
+  dependency-review:
+    uses: LegionIO/.github/.github/workflows/dependency-review.yml@main
+
+  stale:
+    if: github.event_name == 'schedule'
+    uses: LegionIO/.github/.github/workflows/stale.yml@main
+
+  release:
+    needs: [ci]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    uses: LegionIO/.github/.github/workflows/release.yml@main
+    secrets:
+      rubygems-api-key: ${{ secrets.RUBYGEMS_API_KEY }}
+
+  trigger-homebrew:
+    needs: release
+    if: needs.release.outputs.released == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger unified Homebrew build
+        env:
+          GH_TOKEN: ${{ secrets.HOMEBREW_DISPATCH_TOKEN }}
+          LEGIONIO_VERSION: ${{ needs.release.outputs.version }}
+        run: |
+          gh api repos/LegionIO/homebrew-tap/dispatches \
+            -f event_type=build-legion \
+            -f "client_payload[legionio_version]=$LEGIONIO_VERSION" \
+            -f "client_payload[ruby_version]=3.4.8" \
+            -f "client_payload[package_revision]=1"
+
+  docker-build:
+    name: Build Docker Image
+    needs: release
+    if: needs.release.outputs.released == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: |
+            ghcr.io/legionio/legion:${{ needs.release.outputs.version }}
+            ghcr.io/legionio/legion:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/publish-homebrew.yml

@@ -0,0 +1,31 @@
+name: Publish to Homebrew
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  trigger-homebrew:
+    runs-on: ubuntu-latest
+    if: startsWith(github.event.release.tag_name, 'v')
+    steps:
+      - name: Extract version from tag
+        id: version
+        run: |
+          TAG="${RELEASE_TAG}"
+          VERSION="${TAG#v}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Extracted version: $VERSION"
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+
+      - name: Trigger build-legion on homebrew-tap
+        run: |
+          gh api repos/LegionIO/homebrew-tap/dispatches \
+            -f event_type=build-legion \
+            -f "client_payload[legionio_version]=${LEGIONIO_VERSION}" \
+            -f "client_payload[ruby_version]=3.4.8" \
+            -f "client_payload[package_revision]=1"
+        env:
+          GH_TOKEN: ${{ secrets.HOMEBREW_DISPATCH_TOKEN }}
+          LEGIONIO_VERSION: ${{ steps.version.outputs.version }}