
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@ncoderz/awa
Advanced tools
awa is an Agent Workflow for AIs. It is also a CLI tool to powerfully manage agent workflow files using templates.
Structured, traceable AI development.
awa is an Agent Workflow for AIs. It provides a Spec-Driven Design (SDD) workflow with full end-to-end traceability, with tools to enforced consistency and help the AI follow the connections. It is also a powerful templating tool for agent configuration files.
awa was written by awa (AI-assisted development using its own workflows). The workflows themselves are designed and crafted by a human who uses Copilot. If something is wrong, let's fix it together.
Documentation · Quick Start · CLI Reference
AI agents produce output that looks right but isn't connected. Requirements live in one place, implementation in another, tests in a third — nothing links them. The AI doesn't know when it has drifted from the original intent. You don't either, until something breaks.
Agent configuration files diverge too: copy-pasted between projects, modified by hand, silently out of date.
awa provides a structured SDD workflow:
ARCHITECTURE → FEAT → REQUIREMENTS → DESIGN → TASKS → CODE & TESTS → DOCUMENTATION
Every code and test artifact carries an explicit traceability marker (@awa-impl, @awa-test, @awa-component) that links it back to its originating requirement and acceptance criterion. Any line of code traces back to why it was written. Any requirement traces forward to the tests that verify it.
awa check enforces this chain — validating spec structure via YAML schemas and ensuring every acceptance criterion maps to code and tests. awa trace assembles the chain into context so AI agents can navigate it rather than guess.
Agent configuration files are generated from templates — and can be added to your project or updated consistently with a single awa init call.
@awa-component, @awa-impl and @awa-test code markersawa check - allows AI or humans to enforces spec structure via YAML schemas, and to validate traceability markers against spec IDsawa trace - allows AI or humans to explore traceability chains and quickly assemble context from specs, code, and testsawa template diff — shows exactly what changed before you commit; --watch re-diffs on template changesawa template test — verifies templates against fixtures and snapshotsawa template features — discovers available feature flags and presets--json and --summary — flags for CI integrationSee the full documentation for details.
npm install -g @ncoderz/awa
Or use with npx:
npx @ncoderz/awa init .
# Current directory, default template
awa init .
# With specific features
awa init . --features copilot claude cursor
See the Quick Start guide for more.
Several tools address AI-assisted development workflows. Each brings different strengths:
| Tool | Description | Runtime |
|---|---|---|
| awa | Templated agent config generation with spec-driven workflow and traceability | Node + CLI |
| Kiro | IDE with built-in spec-driven development and agent hooks | Standalone IDE + CLI |
| Spec Kit | Python CLI for structured specs with broad agent support (18+) | Python 3.11+ / uv |
| BMAD Method | Agile workflow with role-based AI personas | Shell / Python / yq |
| AI RPI Protocol | Zero-dependency markdown rules for disciplined AI development | None (markdown only) |
awa focuses on two things other tools don't combine: end-to-end traceability (every line of code links back to a requirement via @awa-impl / @awa-test markers, validated by awa check) and templateable agent configuration (feature flags, presets, overlays, diff detection). It's agent-agnostic — one template set generates config for Copilot, Claude, Cursor, Windsurf, and more.
npm install
npm run build
| Command | Description |
|---|---|
npm run build | Build for production (dist/) |
npm run dev | Run CLI in development mode |
npm test | Run tests |
npm run test:watch | Run tests in watch mode |
npm run test:coverage | Run tests with coverage |
npm run check | Run awa check on this project |
npm run lint | Check code with ESLint |
npm run lint:fix | Fix linting issues |
npm run format | Format code with Prettier |
npm run typecheck | TypeScript type checking |
npm run gen:example | Generate example template to outputs/example |
npm run gen:awa | Generate awa templates to outputs/awa |
npm run gen:awa:this | Generate awa templates to current directory |
npm run diff:awa:this | Diff awa templates against current directory |
© 2025-26 ncoderz Ltd. Released under the BSD 3-Clause License.
FAQs
awa is an Agent Workflow for AIs. It is also a CLI tool to powerfully manage agent workflow files using templates.
The npm package @ncoderz/awa receives a total of 294 weekly downloads. As such, @ncoderz/awa popularity was classified as not popular.
We found that @ncoderz/awa demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.