CI playbook
Pipeline Drift Detector
Compares changed pipeline files against peer repositories and documented conventions, reporting runner pins, missing security steps, and widened permissions.
When a pull request changes CI pipeline files, compares the changed pipeline against the same files in the organization's other repositories and against the team's documented CI conventions. Reports divergences such as runner version pins, missing security steps, unusual secret names, or widened permissions so hardening changes do not get lost after copy-paste.
- Identifier
pipeline-drift-detector- Version
- 1.0.0
- Steps
- 5
- Triggers
- 1
- ci
- pipeline
- drift
- compliance
- security
- review
When it runs
pull_request.opened- Settle delay
- 15s after the event
Only when all hold
- pullRequest.isDraft not equals true
- actor.username not in dependabot, dependabot[bot], renovate, renovate[bot], github-actions, github-actions[bot]
- actor.username not contains [bot]
The pipeline
The graph below is the one the workflow opens with in the builder, same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.
- 01PR Opened
triggerThe event that starts the run.
- 02Identify Peer Repositories ⚠️ SET YOUR REPOS
repo.identifyResolves the event to a registered repository.
- 03Clone PR Repository
git.cloneShallow-clones the repository at the right ref.
- 04Detect Pipeline Drift
agent.runOne agent works the task with its toolkit.
- 05Publish Drift Report
report.publishPosts or updates a deduplicated report comment.
The agent
Pipeline Drift Reviewer
- Base type
- Code Reviewer
- Temperature
- 0.2
- Max iterations
- 30
- Tools
- 5
Filesystem · 2
read_fileRead File · readlist_dirList Directory · read
Git provider · 1
get_pull_request_diffGet Pull Request Diff · read
Code search · 1
code_searchCode Search · read
Status · 1
update_statusUpdate Status · write