Tech stack¶
Workflow is a Go modular monolith with a React front end, on PostgreSQL. One binary keeps the Kubernetes footprint small; module boundaries inside it (tracker, workflow, search, identity, scm, automation, service desk) keep the code organised.
| Layer | Choice | Why |
|---|---|---|
| Backend | Go, one binary with wfm serve --mode=web\|hooks\|worker\|all |
Small static images, strong Kubernetes ecosystem |
| API | REST, OpenAPI 3.1 spec-first: oapi-codegen generates the Go server, openapi-typescript the UI's types; SSE for live updates; an MCP server for AI assistants | The spec is the contract for the server, the UI and API clients |
| Database | PostgreSQL 17 on CloudNativePG; pgx; sqlc for queries; goose migrations | One stateful dependency; PgBouncer through a CNPG Pooler keeps connections flat as pods scale |
| Jobs | River (Postgres-backed queue) | Transactional enqueue without Kafka or Redis; periodic jobs run once per cluster |
| Search | PostgreSQL full-text search and pg_trgm; a JQL-like query language compiled to parameterised SQL | No separate search cluster |
| Rules | CEL (cel-go) | Sandboxed, cost-limited expressions for workflow conditions, validators and automation |
| Front end | React 19, TypeScript, Vite, Tailwind CSS, TanStack Router and Query, dnd-kit, React Flow, Tiptap | Boards, the visual workflow editor and Markdown editing |
| Identity | go-oidc (any OpenID Connect provider), a SCIM 2.0 server, Google Admin SDK and Keycloak Admin REST API for directory sync, argon2id and TOTP for local accounts, an OAuth 2.1 authorisation server for MCP clients | Standards-based and provider-agnostic |
| Files | PostgreSQL, or any S3-compatible store | Nothing else to run for small installs |
| Observability | Prometheus metrics with a Grafana dashboard and alert rules, OpenTelemetry traces, JSON logs | Fits an existing monitoring stack |
| Packaging | Distroless image (non-root, read-only root filesystem), Helm chart with a values schema, Cosign signatures and SBOMs from the release workflow | Expected in regulated settings |
| Tests | Go unit and integration tests against PostgreSQL, Vitest, Playwright end to end with axe accessibility checks, Helm lint and kubeconform | See Testing |