AI in CI/CD — a bounded server-side loop

AI belongs in CI/CD when a repeatable server-side task can produce a reviewable change and evidence under constrained permissions. The mature pattern is not “agent deploys everything.” It is a bounded loop: a trusted trigger creates explicit scope, the agent prepares artifacts, deterministic checks verify them, and named humans retain merge and production authority according to risk.

Q13 · Quality gates Max-score evidence: an artifact-driven server loop with auditable permissions, bounded retries, deterministic checks, and human gates for merge and production.

Use the bounded pipeline

1. Accept a trusted trigger. Start from a labeled issue, reviewed specification, scheduled maintenance class, or incident record. Do not execute arbitrary untrusted text with write credentials.
2. Create isolated scope. Use an ephemeral runner or isolated workspace, a narrow token, allowed paths, explicit time and cost limits, and no production credentials.
3. Produce a normal change. The agent writes a branch or draft PR plus a summary of intent, files changed, evidence, residual risk, and rollback notes.
4. Verify outside the model. CI runs types, tests, security checks, policy checks, and build steps. The agent may diagnose failures, but cannot redefine a failing gate as success.
5. Stop or hand off. End after the attempt limit, ambiguity, permission boundary, repeated failure, or elevated risk. A named human decides merge; production uses its established approval and rollback process.

Official integration options include Claude Code GitHub Actions, Cursor Cloud Agents, and the Codex GitHub Action. Their capabilities and flags change, so pin reviewed action versions where possible and re-check official documentation during upgrades.

Prompts for the server task

Implement only the accepted scope in spec.md. Work in the isolated checkout, do not access production or contact external users, run the repository checks, and open a draft PR containing commands run, evidence, unresolved risks, and rollback notes. Stop after two failed repair attempts.

Triage this CI failure. Reproduce it, classify it as product defect, test defect, environment issue, or unknown, and propose the smallest patch. Do not weaken or remove the failing gate without explicit human approval.

Compare the final diff and test evidence with intent.md, spec.md, and plan.md. List satisfied acceptance criteria, gaps, and required human decisions. Do not merge or deploy.

Required controls

• Pin dependencies and actions; restrict repository and workflow permissions to the task.
• Treat issue text, PR comments, logs, and fetched pages as untrusted input.
• Redact secrets from prompts, logs, artifacts, and model output.
• Make retries, timeout, budget, and maximum diff size explicit.
• Fail closed on missing mandatory evidence; show a clear incomplete state when an optional AI step is unavailable.
• Preserve logs linking trigger, accepted scope, agent run, commit, checks, approvals, and release.

Failure pattern: automation outruns authority

The loop is unsafe when it auto-merges or deploys broad changes because tests passed, or when an agent edits CI policy to make itself green. Separate the workflow definition from the agent’s write scope, require review for gate changes, keep production credentials unavailable, and make the smallest possible output a draft PR—not an external side effect.

Continue with deployment governance

Connect this loop to Deploy for promotion and rollback, then measure accepted outcomes with the AI metrics panel.

Deploy Keep release evidence and production authority explicit.

Q22 · AI metrics panel Measure the full system, not generated output.