e-volv

CI playbook

PipelineDriftDetector

Compares changed pipeline files against peer repositories and documented conventions, reporting runner pins, missing security steps, and widened permissions.

When a pull request changes CI pipeline files, compares the changed pipeline against the same files in the organization's other repositories and against the team's documented CI conventions. Reports divergences such as runner version pins, missing security steps, unusual secret names, or widened permissions so hardening changes do not get lost after copy-paste.

Identifier
pipeline-drift-detector
Version
1.0.0
Steps
5
Triggers
1
  • ci
  • pipeline
  • drift
  • compliance
  • security
  • review

When it runs

Pull requestpull_request.opened
Settle delay
15s after the event

Only when all hold

  • pullRequest.isDraft not equals true
  • actor.username not in dependabot, dependabot[bot], renovate, renovate[bot], github-actions, github-actions[bot]
  • actor.username not contains [bot]

The pipeline

The graph below is the one the workflow opens with in the builder — same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.

React Flow
  1. 01
    PR Openedtrigger

    The event that starts the run.

  2. 02
    Identify Peer Repositories ⚠️ SET YOUR REPOSrepo.identify

    Resolves the event to a registered repository.

  3. 03
    Clone PR Repositorygit.clone

    Shallow-clones the repository at the right ref.

  4. 04
    Detect Pipeline Driftagent.run

    One agent works the task with its toolkit.

  5. 05
    Publish Drift Reportreport.publish

    Posts or updates a deduplicated report comment.

The agent

Pipeline Drift Reviewer

Base type
Code Reviewer
Temperature
0.2
Max iterations
30
Tools
5

Filesystem · 2

  • read_fileRead File · read
  • list_dirList Directory · read

Git provider · 1

  • get_pull_request_diffGet Pull Request Diff · read

Code search · 1

  • code_searchCode Search · read

Status · 1

  • update_statusUpdate Status · write