Skip to main content

​
IaC Pipelines

Cloudgeni uses pipelines in your Git provider to inspect infrastructure plans and validate proposed changes. The IaC Pipeline Agent sets up the provider-native definitions and opens a pull request for your team to review.

​
Supported Providers

  • GitHub Actions
  • Azure Pipelines
  • GitLab CI
Jenkins is not available as a managed IaC pipeline provider. For custom automation that calls the Cloudgeni API directly, see the Scanning API.

​
SCAN And VALIDATE Pipelines

The standard setup creates two separate pipelines: Both pipelines publish machine-readable plan or rendered-manifest artifacts. A validation pipeline is more than terraform validate: it must include a plan or equivalent preview that Cloudgeni can inspect.

​
Before You Start

You need:
  • A connected Git provider
  • An IaC repository available in the workspace
  • Permission to create branches, workflow files, and pull requests in that repository
  • Permission to run workflows and configure required CI variables, secrets, or service connections
The agent checks existing pipeline definitions and provider configuration before creating anything. It reuses suitable variables, secret names, variable groups, and service connections when possible.

​
Set Up Pipelines

  1. During guided setup, choose the repository for Scan & validation pipelines. You can also open Pipelines and choose Set up with DevOps Agent when no pipelines are configured.
  2. Select the repository that contains your Terraform, Bicep, Pulumi, ARM, Helm, Kubernetes, or OpenShift configuration.
  3. Start the IaC Pipeline Agent.
  4. Follow the live agent session while it inspects the repository and existing CI configuration.
  5. The agent creates the missing SCAN and VALIDATE definitions on a feature branch.
  6. For Azure Pipelines, GitLab CI, and existing GitHub Actions workflows, the agent registers and tests the pipelines from that branch, then fixes failures before opening a pull request.
  7. Review the pull request opened by the agent, then merge it when you are satisfied with the pipeline and permission changes.
  8. A brand-new GitHub Actions workflow has an additional bootstrap step: GitHub must first index the workflow on the default branch. Merge the setup pull request, then resume the agent session so it can register and run the workflow for the first time.
The agent does not merge the pull request for you.

​
Monitor Runs

Open Pipelines in the workspace to see pipelines grouped by repository. From there you can:
  • Check the latest SCAN and VALIDATE result
  • Open a run to inspect status, duration, logs, and output
  • Trigger an on-demand run
  • Cancel an active run
  • Filter failed, successful, or active runs

​
If Setup Does Not Complete

  • No repositories are listed: connect a Git provider and make the IaC repository available to the integration.
  • The agent cannot create a branch or pull request: update the Git integration’s repository permissions.
  • A workflow cannot authenticate to the cloud: let the agent inspect existing CI configuration, then add the missing secret, variable group, or service connection it identifies.
  • A new GitHub workflow returns 404 during setup: merge the workflow setup pull request, then resume the agent session. GitHub manual dispatch becomes available after the workflow is indexed on the default branch.
  • The pull request exists but no pipeline appears: for a brand-new GitHub workflow, registration follows the bootstrap merge. For Azure Pipelines, GitLab CI, or an existing GitHub workflow, resume the agent session and let it verify the registration.
  • A run succeeds but Cloudgeni cannot read its result: confirm the workflow publishes the JSON plan, what-if result, or rendered manifest artifact configured for that pipeline.

AI DevOps

Learn how agent sessions work.

Configuration Drift

Use SCAN pipeline results to review drift.