> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudgeni.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# IaC Pipelines

> Let the Cloudgeni IaC Pipeline Agent create, test, register, and connect scan and validation pipelines for your repository.

# IaC Pipelines

Cloudgeni uses pipelines in your Git provider to inspect infrastructure plans and validate proposed
changes. The IaC Pipeline Agent sets up the provider-native definitions and opens a pull request for your team
to review.

## Supported Providers

* GitHub Actions
* Azure Pipelines
* GitLab CI

<Note>
  Jenkins is not available as a managed IaC pipeline provider. For custom automation that calls the
  Cloudgeni API directly, see the [Scanning API](/api-reference/scanning-api).
</Note>

## SCAN And VALIDATE Pipelines

The standard setup creates two separate pipelines:

| Type       | Purpose                                                                                       | Typical scope                        |
| ---------- | --------------------------------------------------------------------------------------------- | ------------------------------------ |
| `SCAN`     | Produces plan data for resource inventory, configuration drift, and unmanaged-resource import | All configured environments          |
| `VALIDATE` | Checks proposed IaC changes before a Cloudgeni pull request is ready for review               | The affected environment or IaC path |

Both pipelines publish machine-readable plan or rendered-manifest artifacts. A validation pipeline
is more than `terraform validate`: it must include a plan or equivalent preview that Cloudgeni can
inspect.

## Before You Start

You need:

* A connected Git provider
* An IaC repository available in the workspace
* Permission to create branches, workflow files, and pull requests in that repository
* Permission to run workflows and configure required CI variables, secrets, or service connections

The agent checks existing pipeline definitions and provider configuration before creating anything.
It reuses suitable variables, secret names, variable groups, and service connections when possible.

## Set Up Pipelines

1. During guided setup, choose the repository for **Scan & validation pipelines**. You can also open
   `Pipelines` and choose **Set up with DevOps Agent** when no pipelines are configured.
2. Select the repository that contains your Terraform, Bicep, Pulumi, ARM, Helm, Kubernetes, or
   OpenShift configuration.
3. Start the IaC Pipeline Agent.
4. Follow the live agent session while it inspects the repository and existing CI configuration.
5. The agent creates the missing SCAN and VALIDATE definitions on a feature branch.
6. For Azure Pipelines, GitLab CI, and existing GitHub Actions workflows, the agent registers and
   tests the pipelines from that branch, then fixes failures before opening a pull request.
7. Review the pull request opened by the agent, then merge it when you are satisfied with the
   pipeline and permission changes.
8. A brand-new GitHub Actions workflow has an additional bootstrap step: GitHub must first index
   the workflow on the default branch. Merge the setup pull request, then resume the agent session
   so it can register and run the workflow for the first time.

The agent does not merge the pull request for you.

## Monitor Runs

Open `Pipelines` in the workspace to see pipelines grouped by repository. From there you can:

* Check the latest SCAN and VALIDATE result
* Open a run to inspect status, duration, logs, and output
* Trigger an on-demand run
* Cancel an active run
* Filter failed, successful, or active runs

## If Setup Does Not Complete

* **No repositories are listed:** connect a Git provider and make the IaC repository available to
  the integration.
* **The agent cannot create a branch or pull request:** update the Git integration's repository
  permissions.
* **A workflow cannot authenticate to the cloud:** let the agent inspect existing CI configuration,
  then add the missing secret, variable group, or service connection it identifies.
* **A new GitHub workflow returns 404 during setup:** merge the workflow setup pull request, then
  resume the agent session. GitHub manual dispatch becomes available after the workflow is indexed
  on the default branch.
* **The pull request exists but no pipeline appears:** for a brand-new GitHub workflow, registration
  follows the bootstrap merge. For Azure Pipelines, GitLab CI, or an existing GitHub workflow,
  resume the agent session and let it verify the registration.
* **A run succeeds but Cloudgeni cannot read its result:** confirm the workflow publishes the JSON
  plan, what-if result, or rendered manifest artifact configured for that pipeline.

## Related Pages

<CardGroup cols={2}>
  <Card title="AI DevOps" icon="robot" href="/features/ai-devops">
    Learn how agent sessions work.
  </Card>

  <Card title="Configuration Drift" icon="code-compare" href="/features/configuration-drift">
    Use SCAN pipeline results to review drift.
  </Card>
</CardGroup>