pre-alpha · built in the open

CI/CD configuration is impossible to see all at once. That’s what the grid is for.

Visualize, track, and secure your CI/CD system — for humans and agents.

View on GitHub
The tap repository's workflows drawn as a machinery graph in lanes, with a table of open pull requests below.
One repository, as machinery. The tap repository’s CI/CD drawn as lanes. The PR gate every change rolls through, publish, scheduled, fleet, baseline. Each workflow card carries zizmor’s verdict. Open PRs and the security findings sit beneath.
A triage page listing repositories with open pull requests to review, grouped by product and plugin.
What moved in the last 24 hours. Every repository with something to review, and what it is. The open PRs, their checks, and the plugins they touch. The ones with nothing to do say so.
A table of zizmor security findings across repositories, with a coverage summary below it.
Findings across the organisation. zizmor runs offline over the workflow YAML already on the grid. Every finding lands attached to its workflow, and the workflows the scanner could not read are listed as unknown, not clean.
A workflow YAML file with a security finding highlighted on a line and explained in the right margin.
A workflow file, findings in the margin. One workflow file with every finding marked on the source and called out alongside it, Tufte-style. The workflow’s anatomy is drawn beneath.
A workflow anatomy graph of jobs and steps, with a table of recent runs below.
Anatomy of a workflow. Jobs ranked over what they need, steps inside each, artifacts to the side, and the recent runs beneath with elapsed time against the usual.
A table of collectors and schedules with run state and last-run summaries.
The plumbing. Collectors and their schedules. What reads GitHub, how often, when it last ran, and what it brought back.
A plugin page with identity fields, declared-versus-registered surface counts, and a taxonomy graph of node and edge types with a legend.
A plugin, declared and observed. The github_core plugin page. What the manifest declares against what actually registered, and the taxonomy it contributes to the grid. Every node and edge type with live counts, and in violet, the edges that cross into other plugins’ types.
01 / 07

Why

Answering “What the hell is going on and is it even remotely secure?”

Building, maintaining, and securing a modern CI/CD system is complicated, and the complexity is the bad kind: it isn’t in one place. It’s strewn across workflow files, branch rulesets, environments, org settings, the bots and apps wired into your repos, the third-party services they talk to — and don’t get me started on PATs.

No single screen shows you all of it, so nobody actually knows what it is. That’s the worst of all worlds, and it sits on the most critical of critical paths: the one that ships your software.

What it does

Your CI/CD system, on the grid.

  1. Pulls your running CI/CD system onto the grid

    Repos, pipelines, runs, rules, apps, credentials, and the relationships between them, as one connected graph.

  2. Exactly the pages, views, and affordances you need

    Built to be read by people, and by the agents working alongside them. Extensible, configurable, and built to be tailored to your needs.

  3. Tracks how configuration and operations change over time

    So “what changed?” is a question with an answer. Which you’d think would have already been dealt with, but turns out…

  4. Enables automated, agent-driven security review

    Native agent access to the grid enables your agents to find issues and help fix them.

  5. Does all of it with down-scoped, read-only access

    Blast radius bounded by design, based on credentials you control. It can never be the thing that breaks it.

Running it

Three steps, when it’s ready.

  1. Clone the repo.
  2. Run the install / configure skill.
  3. Tailor it to your liking.

Not yet. Nothing here is installable yet. The roadmap lives in the repo’s milestones. See the milestones ↗

Philosophy

Understand your CI/CD, sleep easier at night.

Master complexity

git-serious tracks and distills what you actually need to know across multiple dimensions. All information can be accessed by humans and agents.

Software as a sophisticated beanbag

Adjust it yourself. Build your own plugins to add pages, views, collectors, whatever you need to understand your system. git-serious ships with GitHub.com, which you can remove, extend, or replace with your own forge. It’s your software, make it do what you want.

The grid

Underneath it all is the data model at the center of The Analogy Platform. Graph representations, history tracking, field-level information provenance, plugin management (uv), and multi-user RBAC right out of the box.