Pattern Proposal: Structural CI/CD Policy Validation
Summary
A workflow validator enforces structural invariants on CI workflows, including hardcoding, pinned installers, dry-run reachability and retired workflows.
Candidate Pattern
- ID:
structural-cicd-policy-validation - Classification: intelligence
- Maturity: established
- Type: implemented
Observed Signals
No specific signals listed.
Evidence
Supporting Evidence
- specs/090-simplify-cicd-workflows/validate_workflows.py (check_yaml_syntax, check_zero_hardcoding, check_no_unpinned_installers, check_no_unreachable_dry_run, check_retired_workflow, check_trigger_remediations, check_composite_action_adoption, main) - Structural workflow policy checks.
- .github/workflows/cas-build-validation.yml - Validation workflow exists for CAS builds.
- .github/workflows/cas-continuous-architecture.yml - Continuous architecture workflow exists.
Scope Assessment
- Evidence Strength: high
- Confidence: high
- Applies to: ideas-to-life-cas
Rationale
- Intent: Prevent brittle or inconsistent automated workflows before they can affect agent-facing continuous execution.
- Context: specs/090-simplify-cicd-workflows/validate_workflows.py contains several check functions and a main entry point.
- Force: CI workflows are execution surfaces for agents or automated systems
- Force: hardcoding and unpinned installers cause drift
- Force: retired workflows and unreachable dry-run paths create ambiguity
Traceability
Artifact source: proposed-patterns