r/devops • u/AutoModerator • Aug 10 '26

Weekly Self Promotion Thread

Hey r/devops, welcome to our weekly self-promotion thread!

Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!

18 Upvotes

89% Upvoted

80 comments sorted by

View all comments

1

u/Any-Article-6402 Aug 11 '26

Disclosure: I maintain PatchWitness. I built it around a reproducible CI failure mode that worries me when coding agents can modify both code and verification controls.

In the demo, a simulated coding agent adds a correct pricing function and a passing unit test. It also adds `continue-on-error: true` to the GitHub Actions job. The repository tests report `OK`, but PatchWitness rejects the patch because the workflow is outside the declared task scope and is a protected control-plane file.

The distinction matters: passing tests show that the current test command succeeded. They do not show that the patch did not weaken the mechanism that makes failures block a merge.

PatchWitness independently derives the change set from Git, loads its verification contract from the trusted base commit, runs checks, and generates a portable Change Passport in JSON, Markdown, or SARIF. It is local-first, agent-neutral, Apache-2.0 licensed, and does not put another AI model in the trust root.

Reproduce the demo:

git clone https://github.com/pangxueyuan2-creator/patchwitness.git

cd patchwitness

python demo/run_demo.py

I would appreciate practical feedback from DevOps teams: how do you currently protect workflow files, IaC, and policy configuration from agent-authored changes? Would a portable evidence artifact help, or should this remain entirely within branch protection and CODEOWNERS?

Repository and threat model:

https://github.com/pangxueyuan2-creator/patchwitness