ENGINEERING CASE STUDY / 02
ZeroPatch CI.
From risky workflows to reviewable fixes. Evidence-first remediation for GitHub Actions.
PROJECT SCOPEStatic validation evidence does not prove runtime workflow safety.
01 / CONTEXT
The problem worth solving.
Finding a risky workflow is only useful when the proposed fix is understandable and safely constrained.
Engineering objectives
- Detect high-confidence controls.
- Limit remediation to supported edits.
- Return reviewable evidence.
02 / SYSTEM DESIGN
Follow the flow.
Implementation details
- YAML structure drives finding detection.
- Checks cover pinning, permissions, triggers, runners, and artifact execution.
- Candidate patches must parse and remove the selected findings.
03 / TRADEOFFS
The reasoning behind the code.
Draft-only output
No workflow execution or merge authority.
Reject ambiguity
Unsupported changes remain review-only.
Engineering challenges
Workflow semantics need more than text matching. Conservative rejection keeps transformations predictable.
Security & performance boundaries
Optional model rationale is disabled by default. Public deployment needs authentication and rate limits.
04 / EVIDENCE
What’s there. What’s next.
Scanner, bounded transformations, validation tests, and an Action integration are available in the repository.
Explore the source, documentation, and tests to inspect the implementation and its current boundaries.
Read the repository