Herd Coded

Describe an app and approve features. GitHub Copilot builds each one and the factory ships it to production.

Comment

Inspiration

At a hackathon, much of the time goes to setup instead of the idea. You create a repo, wire up hosting, configure CI, set secrets, and manage branches. Coding agents can now write features, but someone still has to create the issue, start CI, review the PR, merge it and check the deploy. AI Code Factory was built to remove those manual steps between "here's my idea" and "it's live."

What it does

AI Code Factory is a deployed dashboard protected by a password (Basic Auth). It turns a prompt into a running app and then keeps shipping features to it.

  1. Create a project from a prompt. The factory sets up a new app:
    • It creates a GitHub repo from a Next.js template and a linked Vercel project.
    • It copies over the secrets the app needs.
    • GitHub Models writes the repo description.
    • The prompt becomes a "Build the MVP" issue.
  2. Queue features. You add features one at a time or as a CSV batch. Each feature waits for approval on the project page, so no AI work starts until someone signs off.
  3. Copilot builds, one feature at a time. A per-repo feature queue assigns the GitHub Copilot cloud agent one issue at a time. Running features in order avoids merge conflicts. Copilot works remotely and opens a PR.
  4. The finished PR ships itself. The queue then handles the rest of the PR:
    • It marks the PR ready for review and starts CI.
    • When CI passes, it squash-merges the PR.
    • When CI fails, it asks @copilot to fix the PR, up to 3 attempts.
  5. Every PR gets a preview, and every merge goes to production. Each PR gets a Vercel preview URL with a health check and end-to-end tests. Each merge deploys to production. A smoke test confirms the new commit is the one running, and if the test fails, the deploy rolls back automatically.
  6. Project page. It shows the following:
    • Each feature's state: Queued, Copilot working, PR open or Done.
    • The linked PR, check status, preview URL and production deployment.
    • Queue controls: pause, resume and retry.
  7. Repair. Creating a project is safe to retry. A Repair button fixes any app that is missing its template, workflow, labels, Vercel project or secret.
  8. Local mode. The repo also includes Copilot custom agents and slash prompts for working locally:
    • Roles: architect, planner, builder, tester, reviewer, shipper and demo-coach.
    • Prompts: /kickoff, /feature, /ship, /demo and /rollback.
    • Agents hand work to each other through spec files in specs/<slug>/.

How we built it

  • App: Next.js App Router, using server components and route handlers.
  • GitHub: the REST API handles repos, issues, labels and secrets. The Copilot cloud agent builds features. GitHub Actions runs CI, the feature queue and the auto-ship loop.
  • Vercel: each app gets its own project. The Vercel CLI deploys from GitHub Actions so tests run before production, with preview URLs per PR and instant rollback.
  • GitHub Models: openai/gpt-4.1-mini writes repo descriptions. If it fails, the factory uses the prompt's first sentence instead.
  • Secrets: repository secrets are encrypted with tweetnacl and blakejs before upload.
  • Testing: Biome, TypeScript, Vitest and Playwright, all run by npm run verify.
  • Demo mode: USE_MOCKS=true serves seeded projects from memory, so the demo and end-to-end tests run without any credentials.
  • Infrastructure: free tiers only. Terraform is included but optional.

Challenges we ran into

  • The default Actions GITHUB_TOKEN can't assign the Copilot agent, so the factory uses a personal access token (PAT) secret in each app.
  • GitHub requires a manual "Approve workflows" click for any CI run started by Copilot, and Copilot's draft PRs never merged. To avoid both, the ship loop starts only from events that don't need approval and polls for Copilot and CI status.
  • Running several Copilot sessions in one repo caused merge conflicts. Processing the queue one feature at a time fixed this.
  • libsodium-wrappers has a broken ESM build, so secret encryption was rebuilt on tweetnacl and blakejs.
  • A Vercel rollback doesn't undo database schema changes, so database migrations have to stay backward-compatible.

Accomplishments that we're proud of

  • Going from a prompt to a live production URL takes no manual git, CI or deploy steps.
  • Human approval stays at the right point: someone approves the feature, and everything after that is automated.
  • Failed deploys roll back on their own, and failed CI goes back to Copilot to fix.
  • The entire demo runs offline in mock mode.

What we learned

  • Coding agents are capable. The harder part is the surrounding process: permissions, starting workflows, merging and recovering from failures.
  • Plain spec files make a reliable hand-off between agents and people.
  • Running features in order beats running them in parallel when the goal is a reliable demo.

What's next for AI Code Factory

  • Replace the shared PAT with a GitHub App that has narrower permissions.
  • Automatically turn runtime errors into incident issues once a monitoring provider is connected.
  • Support multiple users.

Discovery Insights Hub: Executive Summary, Personas & Core Themes

Project Focus: Bridging the Discovery Gap via the Enterprise App Factory & Problem Triage Platform

Executive Summary

Across in-depth discovery interviews with technical leaders and engineers, a consistent systemic failure was identified:

  1. Business units identify a localized symptom in isolation.
  2. They pre-select a vendor platform or build an ad-hoc "Shadow AI" / spreadsheet tool to bypass perceived IT delays.
  3. They hand down a prescriptive solution mandate to IT and Engineering late in the process (at the ~70% mark).
  4. Engineers struggle with restrictive vendor APIs, data silos, or compliance overhead.
  5. Brittle custom workarounds are built, resulting in low platform adoption and fragile architectures.
  6. Business leadership perceives internal IT delivery as slow, reinforcing the cycle of bypassing internal teams.

Key Discovery Metrics

  • 70% to 80% of IT project engagements arrive as prescriptive feature mandates ("here is what we want, how will you implement it?") rather than open problem statements.
  • 10 or more hand-offs occur across teams for simple transactions, codifying organizational silos (Conway's Law).
  • 2 to 3 months of engineering effort is frequently wasted when separate teams build duplicate tools (e.g., parallel RAG chatbots or redundant order screens) in isolation.
  • Unauthenticated AI scripts and shadow tools run on sensitive production data without governance, creating data security and regulatory compliance risks.

Personas

1. Engineer Director

  • Primary Lens: Strategic Governance, Funding Models, and Enterprise Orchestration
  • Core Frustrations:
    • Departmental Funding Silos: Budgets are allocated by department (R&D vs. Commercial), meaning teams only solve narrow local problems rather than building unified enterprise capabilities.
    • Hidden Total Cost of Ownership: Project budgets only account for initial implementation costs, ignoring ongoing maintenance for custom hybrid builds.
    • Proliferation of Shadow IT: Non-technical employees build unregulated tools because official enterprise procurement is slow and cumbersome.
  • Key Quote: "There is no unifying enterprise capability. How we fund things determines what we build... so we end up implementing Conway's Law and codifying our organizational dysfunction."
  • Unmet Needs:
    • An enterprise problem triage mechanism and common backlog.
    • An automated governance framework based on company Code of Conduct and role-based permissions.

2. Senior Engineer

  • Primary Lens: Product Delivery, Developer Velocity, and Prototyping
  • Core Frustrations:
    • Restrictive Vendor Software: Off-the-shelf platforms rarely solve 100% of the workflow, forcing engineers to build custom integration layers around locked-down APIs.
    • Heavy Prototyping Red Tape: Setting up cloud environments, test data, and permissions for a lightweight POC requires weeks of paperwork in a regulated pharma setting.
    • Invisible Duplicate Work: Discovered another team building the exact same RAG developer documentation bot only through accidental, informal networking.
  • Key Quote: "It should not be a hierarchy from business to product to engineers. It should be a circle where we all sit in the same room from day one."
  • Unmet Needs:
    • A true "Product Trio" operating model (Business, Product/Design, and Engineering sitting together early).
    • A 1-click cloud sandbox to build, test, and share prototypes with business sponsors in hours.

3. Principal Engineer

  • Primary Lens: Middleware, Data Pipelines, and System Architecture
  • Core Frustrations:
    • Symptom vs. System Trap: Business requests solve 25% of a task (like adding another UI screen) while ignoring that the end-to-end data pipeline is broken.
    • Late IT Engagement: Engineers are pulled in after conclusions are already made, leaving no room to propose simpler or more scalable architectural alternatives.
    • Discarded Work: Built a custom AI ad-compliance detection tool, only for business to abandon it for a third-party vendor tool that did not fit existing data structures.
    • Wild West AI Risks: Untrained staff deploy unauthenticated AI tools with sensitive data without understanding cyber or regulatory risks.
  • Key Quote: "Business is offering a solution to a problem that's 25% of the overall issue. It is like stopping the bleeding on a finger while still missing the entire arm."
  • Unmet Needs:
    • Upfront problem-framing discovery workshops.
    • A central catalog of existing APIs and microservices to prevent redundant data transformations.

Core Themes

Theme 1: Solution Mandates vs. Open Problem Statements

  • Root Cause: Business units jump directly to vendor demos or pre-conceived features due to lack of shared discovery practices and historical mistrust in IT delivery speed.
  • Evidence: Business stakeholders bring specific feature requests ("how do you implement this?") rather than describing the underlying user struggle or bottleneck.
  • Impact: High spend on low-adoption platforms; engineering is forced into building brittle custom wrappers on top of ill-fitting software.

Theme 2: Shadow IT and Ungoverned Citizen AI

  • Root Cause: Enterprise IT procurement and cloud access processes take 12 to 24 weeks, driving employees to build their own workarounds.
  • Evidence: Business users write custom AI personas and scripts to pull and process data locally without security reviews.
  • Impact: High regulatory compliance exposure, data leakage risks, and unmaintained shadow tools operating on production data.

Theme 3: Conway's Law and Departmental Silos

  • Root Cause: Fragmented funding models incentivize departments to fund and optimize tools exclusively for their own functional scope (e.g., R&D vs. Commercial).
  • Evidence: Process flows map out 10 handoffs across multiple teams for data transactions that should take under 2 minutes.
  • Impact: Multi-week communication delays, over-engineered data pipelines, and lack of coherent enterprise data flow.

Theme 4: Prototyping Overhead and Fear of Innovation

  • Root Cause: Lack of pre-approved, compliant sandbox environments for engineering teams.
  • Evidence: Engineers face extensive paperwork and delays just to provision cloud memory and share a prototype with remote colleagues.
  • Impact: Engineers default to passive "order-taking" mode, and business leaders assume internal teams cannot deliver rapid value.

Theme 5: Invisible Duplication Across Teams

  • Root Cause: Absence of a centralized registry of internal APIs, active proofs-of-concept, or reusable software components.
  • Evidence: Multiple teams independently built custom order screens across SAP, CRM, and Power BI without coordination.
  • Impact: Millions of dollars in wasted engineering cycles and overlapping software licenses.

Built With

  • biome
  • github-actions
  • github-copilot
  • github-models
  • nextjs
  • playwright
  • react
  • typescript
  • vercel
  • vitest
Share this project:

Updates

Submission history