Goal: Expand the infrastructure for the project (Python/FastAPI + JS) and automate the code review process using LLM (AI agents) with a focus on security and Multi-tenancy.
1. Stage: Infrastructure Setup (The Core)
• Version Control: Set up a private repository on GitHub. Configure branch protection rules so that code does not enter main without review.
• Environment Management: Move all sensitive data (API keys, DB credentials, Proxy settings) to GitHub Secrets and .env files. Zero hardcoded secrets policy.
• Documentation Hub: Deploy Notion (or Linear) as the central task manager and knowledge base.
2. Stage: AI-Pipeline Automation (The Synergy)
It is necessary to implement an automatic chain (via GitHub Actions):
1. Trigger: The developer creates a Pull Request or makes a push.
2. Action: The system extracts the code differentiation (diff) and sends it via API to LLM (Claude 3.5 Opus / GPT-4o).
3. AI Analysis (Security & Architecture):
• Audit for leakage of server IP/domains in frontend code.
• Check the logic of header masking (Fingerprinting spoofing).
• Control the presence of tenant_id in all new DB models and Redis queries.
4. Reporting: The result of the review is automatically published in Notion and as a comment to the Pull Request in GitHub.
3. Stage: Security & Risk Management
• Least Privilege Access: Configure access so that the AI operator does not have access to "live" user databases.
• Isolation: Set up Staging (test) and Production servers. Automatic deployment to Production is only possible after an APPROVED status from the AI agent and manual approval from the owner.
• Audit Log: All actions with code and access to servers must be logged.