Agentic Accelerator Framework

GitHub Advanced Security + GitHub Copilot Custom Agents + Microsoft Defender for Cloud
Shift-left security and compliance across Security, Accessibility, Code Quality, FinOps, and APM Security

---

Overview

The Agentic Accelerator Framework provides a repeatable, org-wide approach to shifting security and compliance left using custom GitHub Copilot agents. It covers five domains — Security, Accessibility, Code Quality, FinOps, and APM Security — with SARIF-based CI/CD integration across GitHub Actions and Azure DevOps.

The framework operates on a "shift-left then scale" principle:

1. Shift Left: Custom GHCP agents run in VS Code (IDE) before commit and in GitHub platform during PR review.
2. Automate: CI/CD pipelines (GitHub Actions + Azure DevOps Pipelines) run the same controls as automated gates.
3. Report: All findings output SARIF v2.1.0 for unified consumption (GitHub Code Scanning + ADO Advanced Security).
4. Govern: Security Overview + Defender for Cloud + Defender for DevOps + Power BI dashboards provide centralized governance.

Architecture

graph TB
    subgraph "Developer Workstation (VS Code)"
        A[Custom GHCP Agents<br/>Security • A11y • Quality • FinOps] --> B[Pre-screened Code]
        I[Instructions + Skills] --> A
        P[Prompt Files] --> A
    end

    subgraph "GitHub Platform"
        B --> C[Pull Request]
        C --> D[Custom Agents<br/>Coding Agent + Code Review]
        D --> E[GitHub Actions CI/CD]
        E --> F[SARIF Results Upload]
    end

    subgraph "Security Controls Pipeline"
        E --> G1[Secrets Scanning - Push Protection]
        E --> G2[SCA - Dependabot + SBOM]
        E --> G3[SAST - CodeQL + Copilot Autofix]
        E --> G4[IaC Scanning - MSDO + Checkov + Trivy]
        E --> G5[Container Image Scanning]
        E --> G6[DAST - ZAP]
        E --> G7[Accessibility - axe-core + IBM]
        E --> G8[Code Coverage ≥80%]
        E --> G9[Agent Config - APM audit]
        G1 & G2 & G3 & G4 & G5 & G6 & G7 & G8 & G9 --> F
    end

    subgraph "Centralized Governance"
        F --> H1[GitHub Security Overview]
        F --> H2[Microsoft Defender for Cloud]
        H2 --> H3[Defender for DevOps]
        H1 --> H4[Security Campaigns + Autofix]
    end

    subgraph "Azure Cloud"
        E --> AZ1[Azure Cost Management APIs]
        AZ1 --> AZ2[FinOps Governance + Alerting]
    end

Agent Inventory

The repository ships 23 custom GitHub Copilot agents. Sixteen production agents are deployed org-wide to the devopsabcs-engineering/.github-private repository (integrity-verified by the SHA-256 manifest in deploy-to-github-private.yml). The remaining seven are repo-local workshop and scaffolding helpers used for the DIY and workshop experiences.

Custom Agents Deployed to .github-private (16)

These agents are synced to the org-wide private configuration repository and pinned to model: Claude Opus 4.8 (copilot).

Agent	Domain	Source File	SARIF Category	Description
SecurityAgent	Security	agents/security-agent.agent.md	security/	Holistic security review orchestrator — ASP.NET Core, IaC, CI/CD, supply chain
SecurityReviewerAgent	Security	agents/security-reviewer-agent.agent.md	security/	Security-focused code reviewer detecting OWASP Top 10 vulnerabilities in source
SecurityPlanCreator	Security	agents/security-plan-creator.agent.md	security/	Security architect that builds cloud security plans from IaC blueprints
PipelineSecurityAgent	Security	agents/pipeline-security-agent.agent.md	security/	Hardens GitHub Actions and Azure DevOps YAML; emits patched workflows
IaCSecurityAgent	Security	agents/iac-security-agent.agent.md	security/	Scans Terraform, Bicep, ARM, Kubernetes, and Helm for misconfigurations
SupplyChainSecurityAgent	Security	agents/supply-chain-security-agent.agent.md	security/	Detects secrets, dependency vulnerabilities, and repo governance gaps
A11yDetector	Accessibility	agents/a11y-detector.agent.md	accessibility-scan/	WCAG 2.2 Level AA compliance detector (axe-core, IBM Equal Access, custom checks)
A11yResolver	Accessibility	agents/a11y-resolver.agent.md	accessibility-scan/	Accessibility remediation with verification re-scan
CodeQualityDetector	Code Quality	agents/code-quality-detector.agent.md	code-quality/coverage/	Code quality and coverage analysis; flags below-threshold functions
TestGenerator	Code Quality	agents/test-generator.agent.md	code-quality/coverage/	Auto-generates tests for uncovered code (happy path, error paths, edge cases)
CostAnalysisAgent	FinOps	agents/cost-analysis-agent.agent.md	finops-finding/v1	Cost Management API queries; cost reports by group, service, and tag
FinOpsGovernanceAgent	FinOps	agents/finops-governance-agent.agent.md	finops-finding/v1	Tag compliance and governance monitor
CostAnomalyDetector	FinOps	agents/cost-anomaly-detector.agent.md	finops-finding/v1	Cost anomaly detection and root-cause investigation
CostOptimizerAgent	FinOps	agents/cost-optimizer-agent.agent.md	finops-finding/v1	Right-sizing, reserved instances, and idle-resource savings
DeploymentCostGateAgent	FinOps	agents/deployment-cost-gate-agent.agent.md	finops-finding/v1	Deployment gatekeeper estimating IaC change costs against budget
ReverseEngineerSpec	Spec / Modernization	agents/reverse-engineer-spec.agent.md	n/a	Reverse-engineers current-state Spec-Kit slices from brownfield repos (four-pass)

Additional Repo-Local Agents (7)

These support the workshop and DIY domain-scaffolding experiences and are not part of the org-wide deployment manifest.

Agent	Domain	Source File	Purpose
APMSecurityDetector	APM Security	agents/apm-security-detector.agent.md	Agent-config security scanner (APM audit, semantic patterns, MCP validation)
APMSecurityResolver	APM Security	agents/apm-security-resolver.agent.md	Agent-config remediation (Unicode stripping, CODEOWNERS, MCP allowlist)
Accessibility Workshop Agent	Accessibility	agents/a11y-workshop.agent.md	Guides students through accessibility scanning labs
Code Quality Workshop Agent	Code Quality	agents/code-quality-workshop.agent.md	Guides students through code-quality scanning labs
FinOps Workshop Agent	FinOps	agents/finops-workshop.agent.md	Guides students through FinOps scanning labs
APM Security Workshop Agent	APM Security	agents/apm-security-workshop.agent.md	Guides students through APM Security scanning labs
DomainScaffolder	Platform	agents/domain-scaffolder.agent.md	Scaffolds new domain scanner demo-app and workshop repositories

Repository Structure

This repository uses the .github-private org-wide layout where agent configuration directories are at the repo root:

agents/                  ← 23 custom GHCP agent definitions (.agent.md); 16 deployed org-wide
instructions/            ← Path-specific instruction files (a11y-remediation, code-quality, wcag22-rules)
prompts/                 ← Reusable prompt templates (a11y-fix, a11y-scan)
skills/                  ← On-demand domain knowledge (a11y-scan, security-scan)
scripts/                 ← Agent validation tooling (validate-agents.mjs)
apm.yml                  ← APM dependency manifest
mcp.json                 ← MCP server configuration (ADO work items)
.github/
  CODEOWNERS             ← Mandatory security-team review for agent config paths
  copilot-instructions.md ← Repo-wide Copilot conventions
  instructions/          ← Workflow instructions (ado-workflow)
  skills/                ← Additional skills (docx, pdf, pptx, xlsx, Power BI)
  workflows/             ← 7 GitHub Actions CI/CD pipelines
docs/                    ← Framework documentation (9 guides)
sample-app/              ← Next.js demo application with Bicep infrastructure
samples/
  azure-devops/          ← 3 sample ADO pipeline YAML files

CI/CD Workflows

Workflow	Trigger	Purpose
security-scan.yml	PR and push to main	SCA, SAST (CodeQL), IaC, container, and DAST scanning
accessibility-scan.yml	PR and weekly schedule	Three-engine a11y scan with threshold gating
code-quality.yml	PR	Lint, type check, test, and 80% coverage gate
finops-cost-gate.yml	PR (IaC file changes)	Infracost estimate against monthly budget
apm-security.yml	PR (agent config file changes)	APM audit for prompt file supply chain attacks
ci-full-test.yml	Push and PR to main	Agent validation (structure, cross-refs, domain rules)
deploy-to-github-private.yml	Push to main	Syncs agent config to org-wide .github-private repository

Quick Start

1. Clone this repository (or use as .github-private for org-wide deployment).
2. Review the 23 agent definitions in agents/ (16 are deployed org-wide).
3. Customize instructions/ and prompts/ for your organization's standards.
4. Enable GitHub Actions workflows for CI/CD integration.
5. Configure mcp.json with your Azure DevOps organization details.
6. Run apm audit to validate agent configuration file integrity.

Documentation

• Architecture — Framework architecture and design patterns
• Agent Patterns — Agent file specification and YAML frontmatter schema
• Agent Extensibility — Plugin architecture, MCP integration, and APM dependency management
• SARIF Integration — SARIF v2.1.0 mapping for all domains
• Platform Comparison — GitHub vs Azure DevOps feature comparison
• Azure DevOps Pipelines — ADO YAML pipeline equivalents for each workflow
• Centralized Governance — Dual-platform dashboards and Defender for Cloud integration
• Prompt File Security — Threat model and APM defense for agent configuration files
• Implementation Roadmap — Phased rollout plan
• Domain Parity and Contribution Guide — Cross-domain feature parity comparison and guide for contributing new domains

Standards

• SARIF v2.1.0: OASIS SARIF specification for unified findings output
• WCAG 2.2 Level AA: W3C accessibility standard
• OWASP Top 10: Application security risks
• OWASP LLM Top 10: AI/LLM security risks
• CIS Azure Benchmarks, NIST 800-53, PCI-DSS: Compliance frameworks

Workshops

• Agentic Accelerator Workshop — Hands-on workshop for building and deploying custom GitHub Copilot agents with the Agentic Accelerator Framework
• Accessibility Scan Workshop — Workshop for WCAG 2.2 Level AA accessibility scanning and remediation using custom agents
• Code Quality Scan Workshop — Workshop for code quality scanning with ESLint, Ruff, jscpd, Lizard, and coverage tools
• FinOps Scan Workshop — Workshop for Azure cost optimization and FinOps governance using custom agents
• APM Security Scan Workshop — Workshop for agent configuration file security scanning with Unicode, semantic, and MCP validation engines

Domain Repositories

Each domain has a scanner platform repo (demo-app) and a workshop template repo:

Domain	Scanner Platform	Workshop
Accessibility	accessibility-scan-demo-app	accessibility-scan-workshop
Code Quality	code-quality-scan-demo-app	code-quality-scan-workshop
FinOps	finops-scan-demo-app	finops-scan-workshop
APM Security	apm-security-scan-demo-app	apm-security-scan-workshop

DIY: Build a New Domain

Ready to build the Code Quality domain from scratch? The framework includes a DomainScaffolder agent and complete automation artifacts for generating scanner demo-app and workshop repositories with full parity to the existing Accessibility, Code Quality, and FinOps domains.

See the DIY: Build the APM Security Domain guide for step-by-step instructions covering repo creation, sample app development, SARIF converters, workshop labs, Power BI PBIP, and ADO pipeline setup.

License

This project is licensed under the MIT License.