CI/CD WORKFLOWS

The release path is where trust becomes execution.

Uncain began with the workflow because the workflow is where outside trust turns into running code. A release path can call upstream Actions, inherit authority, touch secrets, and write history. That path deserves its own graph.

01

STRUCTURE

Read the workflow as authority.

A workflow file describes more than jobs and steps. It describes who can cause execution, which upstream projects enter the path, and what authority the run can reach once it starts.

  • Workflow and reusable workflow relationships
  • External Action lineage and resolved refs
  • Secrets, environments, permissions, and release boundaries
02

DRIFT

Watch the parts that move.

Uncain watches trust-bearing workflow change: upstream refs, permissions, dependency subscriptions, and the structure of release paths. Drift matters because the same green run may no longer mean the same thing.

  • Hot-path workflow and Action detection
  • Upstream monitoring for selected workflow dependencies
  • Incident summaries tied to affected release paths
03

RESPONSE

Contain before the next run.

When a supported workflow path crosses policy, Uncain can cancel live execution, quarantine future execution, and open structured remediation work instead of leaving operators with another queue to triage.

  • Cancel runs and quarantine trust objects on supported findings
  • Approval gates and policy exceptions where teams need judgment
  • Remediation PRs for supported workflow fixes

PRINCIPLE

Workflow trust should be inspectable.

Open the graph before a release path runs.

Open Uncain