Agentic GitOps: AI Agents That Review, Approve, and Merge Your Infrastructure PRs

import anthropic
import json
 
client = anthropic.Anthropic()
 
REVIEW_PROMPT = """You are reviewing an infrastructure change for auto-merge eligibility.
 
PR: {title}
Files changed: {files_changed}
Terraform plan output:
{plan_output}
 
Recent incident history for affected resources (last 30 days):
{incident_history}
 
Current blast radius: {affected_resource_count} resources, environments: {environments}
 
Decide: AUTO_APPROVE, REQUIRE_HUMAN_REVIEW, or REJECT
 
Auto-approve only if ALL of these hold:
- Change is additive or a well-understood pattern (tag update, scaling within
  existing bounds, non-breaking version bump)
- No resource in the plan has had an incident in the last 30 days
- Blast radius is a single environment, not production + staging simultaneously
- No IAM policy or security group change is broadening access
 
Respond with ONLY valid JSON:
{{"decision": "...", "reasoning": "...", "risk_factors": ["..."]}}"""
 
 
def review_infra_pr(pr_data: dict) -> dict:
    response = client.messages.create(
        model="claude-sonnet-5",
        max_tokens=500,
        messages=[{"role": "user", "content": REVIEW_PROMPT.format(**pr_data)}]
    )
    text = response.content[0].text.strip()
    if text.startswith("```"):
        text = text.split("```")[1].replace("json", "", 1).strip()
    return json.loads(text)

AUTO_MERGE_SCOPE = {
    # Only these resource types are eligible for auto-merge, ever
    "allowed_resource_types": [
        "aws_autoscaling_policy", "kubernetes_horizontal_pod_autoscaler",
        "aws_cloudwatch_metric_alarm",
    ],
    # These always require a human, no matter what the agent decides
    "always_human": [
        "aws_iam_policy", "aws_security_group_rule", "aws_kms_key",
        "aws_route53_record", "aws_db_instance",
    ],
    "max_resources_per_auto_merge": 5,
    "environments_eligible": ["staging", "dev"],    # never prod, initially
}
 
 
def enforce_scope(pr_data: dict, agent_decision: dict) -> dict:
    """Hard-coded rules that override the agent — never trust the LLM alone for the gate."""
    changed_types = extract_resource_types(pr_data["plan_output"])
 
    if any(t in AUTO_MERGE_SCOPE["always_human"] for t in changed_types):
        return {"decision": "REQUIRE_HUMAN_REVIEW", "reasoning": "Touches an always-human resource type"}
 
    if pr_data["environments"] not in (["staging"], ["dev"]):
        return {"decision": "REQUIRE_HUMAN_REVIEW", "reasoning": "Production is not in auto-merge scope"}
 
    if pr_data["affected_resource_count"] > AUTO_MERGE_SCOPE["max_resources_per_auto_merge"]:
        return {"decision": "REQUIRE_HUMAN_REVIEW", "reasoning": "Blast radius exceeds auto-merge limit"}
 
    return agent_decision    # Only defer to the agent once the hard rules pass

# ArgoCD ApplicationSet annotation pattern for agent-reviewed changes
metadata:
  annotations:
    devopsboys.com/reviewed-by: "agentic-gitops-v1"
    devopsboys.com/review-decision: "auto-approved"
    devopsboys.com/review-scope: "staging-autoscaling"