In the enterprise world, release pipelines are often a fragile patchwork of scripts, ad-hoc gates, and tribal knowledge. IaC drifts. Supply chains get compromised. Architecture diagrams stale the moment they are exported. Application code ships with incomplete provenance. We have all been there, fighting drift in Terraform modules one week, chasing a CVE in a container image the next, while trying to keep service maps current for both humans and agents.
At Fremen Labs, we built ReleaseFlow and Navo to end that chaos. Together, they give you immutable, policy-driven releases and a living, Git-native architecture map that stays in lockstep with your code. Here is how to use them in concert to keep your infrastructure-as-code, build artifacts, and application code secure, auditable, and thoroughly documented, without adding yet another heavy platform or portal to maintain.
Why This Combination Matters
ReleaseFlow decouples release orchestration from your CI/CD tool of choice. Every release lives in an immutable YAML manifest, your single source of truth for versioning, SBOMs, scans, signatures, and promotion gates. It supports universal artifacts: Docker images, Terraform modules, Ansible collections, Python packages, you name it. Native Trivy, Syft, Cosign integration plus policy-as-code gates and even dynamic red-teaming for AI components.
Navo turns your Git repository into the canonical architecture browser. YAML-defined services, edges, groups, and docs compile into interactive Cytoscape graphs (2D/3D), in-app wikis, and an MCP server for AI agents. CLI tools handle scanning codebases, importing legacy diagrams like Lucidchart, draw.io, Mermaid, and keeping maps fresh via CI. No more drifting slides or Backstage ops overhead.
When you wire them together, changes to IaC or app code flow through validated manifests into living documentation. Security is not an afterthought; it is enforced and visible. Provenance is not buried in logs, it is now attached to nodes in your architecture map.
Step-by-Step: Integrating ReleaseFlow + Navo
Assume a typical monorepo or multi-repo setup with Terraform IaC, Ansible playbooks, and application services. Adjust paths as needed.
1. Bootstrap Your Release Manifests with ReleaseFlow
Start in your repo root or per-service:
rflow manifest init
This creates .rflow.yaml and a baseline release-manifest.yaml. Define your artifacts:
# .rflow.yaml example
version: "0.1.0"
artifacts:
- name: platform-iac
type: terraform
path: infra/terraform
build: terraform init && terraform validate
- name: app-service
type: docker
path: services/api
dockerfile: Dockerfile
- name: ansible-collections
type: ansible
path: automation/collections
Run rflow manifest generate in CI to bump SemVer, generate the immutable manifest, and tag the commit. This becomes the anchor for everything downstream.
2. Secure the Build and Scan Pipeline
Embed ReleaseFlow steps in GitHub Actions, Azure DevOps, or GitLab CI:
# Example GitHub Actions snippet
- name: ReleaseFlow Bootstrap & Build
run: |
rflow manifest generate
rflow build
rflow sbom generate
rflow scan --trivy --policy strict
rflow sign --keyless
- name: Promote on Green
if: success()
run: rflow promote --env staging --gate approval
Gates can reference custom policies. Think no critical CVEs, SBOM completeness, and/or AI-BOM for any generated code. Failed gates block promotion. Full audit trail in the manifest.
3. Keep Architecture Living with Navo
Add Navo to the same pipeline, or a dedicated architecture job:
# After successful ReleaseFlow manifest/promote
navo scan --path . --output architecture.yaml --include "**/main.tf,**/*.yaml,**/Dockerfile"
navo compile
Navo's CLI uses AST analysis to extract services, dependencies, and IaC relationships automatically. Import legacy diagrams once:
navo convert --input legacy-diagram.drawio --output architecture.yaml
Commit the updated architecture.yaml or let a bot PR it. Navo validates schema in CI, builds the static SPA graph + wiki, and deploys it Docker/nginx, K8s, static host.
In your architecture.yaml, enrich nodes with ReleaseFlow references:
services:
- id: platform-iac
name: Platform Terraform
type: iac
group: infrastructure
releaseflow:
manifest: release-manifest.yaml
last-release: v1.2.3
sbom: sbom.json
status: secure
wiki: runbooks/iac.md
links:
- app-service
4. Visualize, Document, and Govern in One Place
Browse your Navo SPA:
- Interactive graph: Filter by group --> edge, domain, iac, data, zoom, explore relationships.
- Service detail pages: Click a Terraform module --> ReleaseFlow manifest, latest scan results, SBOM summary, linked wiki/runbook, owners, and runtime context Kubernetes.
- In-app wiki: Markdown docs attached to nodes --> deployment procedures, security controls, architecture decisions.
- MCP endpoint: Feed the exact same Git-provenanced map to your agents --> Cursor, Claude, Copilot, OpenAI --> so they reason over real topology, not hallucinations.
Changes to IaC? Navo scan picks them up --> updated graph. New CVE blocks a ReleaseFlow promote? The "secure" badge on the node turns red and wiki notes surface the gate failure. Perfect for compliance audits and onboarding.
5. Advanced: Agentic Workflows and Continuous Assurance
Pair with Fremen Labs tools like Elastro/LogLoom or your existing observability:
- ReleaseFlow manifests feed into LogLoom for semantic provenance.
- Navo MCP lets agents query "Show me all Terraform modules with open critical findings" and propose PRs.
- Set Navo health checks in CI: "Architecture drift score > threshold? Fail build."
This closes the loop: Code → Secure Release with ReleaseFlow → Living Map + Docs with Navo → Agent-augmented reviews → Repeat.
Real-World Outcomes
Teams using this pattern report:
- Zero drift: between deployed IaC and documented architecture.
- Faster audits: everything from SBOM to service relationships traceable in Git.
- Reduced meeting time: stakeholders self-serve the map instead of asking architects.
- Better security posture: policy gates + visible provenance catch issues early.
- AI readiness: agents operate with trustworthy system context.
Getting Started
- Head to releaseflow.fremenlabs.com — free for individuals/open source, straightforward Team/Enterprise plans.
- Try Navo at navo.fremenlabs.com — unlimited viewers free, simple Team pricing.
- Bootstrap a repo with both CLIs and wire into your existing pipeline. Reach out at info@fremenlabs.com for a guided PoC.
Stop treating releases and architecture as separate concerns. Make them converge in Git, enforced by policy, visible to everyone and every agent.
