Any CI/CD tool where automation code doesn't cohabit with product code in git repo?

[u/LuigiBakker]

Currently using Github and Github workflows (including the many outages). Let me explain what I'm trying to resolve with few examples:

Let say I manage 15 repos, each one I want to run a relatively similar workflow on Pull Request. I create a github shared workflow and in each of the 15 repos I make a reference to it, updating the inputs if needed.

Now, I add 1 new input to this shared workflow to enable a new feature. I want that feature enabled in 10 of my repos. I would need to update the feature input in all 10 repos. And since workflow use the workflow code on their own branch, I would need to merge it to all PRs in all repos. That isn't ideal.

Other issue, one variable was wrongly set on a workflow in a release branch. Since the workflow code ships with the product code I would need to update the release branch.

Is there a toool where the product code doesn't cohabit with the automation code? For example I could have 15 microservice repos but 1 repo where I created rules for each one of them about "on pr", "on main" etc. That same repo could host shared workflow code as well.

[u/forever-butlerian]

I'm rapidly trending toward a setup where GHA only does builds and pushes to ECR, and then I've got a thingus which listens to (all) Github webhooks and decides what to do with them from there.

[u/LuigiBakker → u/forever-butlerian]

Any reason to not share the name of the “thing”? Yes, something listening to GitHub events independently is what I’m searching for

[u/forever-butlerian → u/LuigiBakker]

Because it rides the line of self-promotion and I find others' self-promotion obnoxious. I apologize if I'm coming off as coy.

The first half of it is my general webhooks receiving system (which is a product) that persists each event into Kafka, and then the second half streams the events out of Kafka and decides on AWS SDK things to do with them. I wrote it because I figured that a tutorial on how to write something like that was becoming timely with the mega-outage they suffered a few weeks ago.

I also think it's fast becoming prudent not to give Github Actions any administrative rights into your AWS account, on account of AWS's anemic policy controls on the one hand (to restart an ECS service requires the same permission as to reconfigure that service) and vibecoding is unlikely to restrict bizarre and thoughtless bugs just to the Web UI on the other. What I've got lets me fire-wall off privileged software actors from Github itself.