pre-alpha · built in the open

CI/CD configuration is impossible to see all at once. Getting it wrong is catastrophic.

Visualize, track, and secure your CI/CD system — for humans and agents.

View on GitHub
The tap repository's workflows drawn as a machinery graph in lanes, with a table of open pull requests below.
One repository, as machinery. The tap repository’s CI/CD drawn as lanes. The PR gate every change rolls through, publish, scheduled, fleet, baseline. Each workflow card carries zizmor’s verdict. Open PRs and the security findings sit beneath.
The organisation's repositories and workflows drawn as nested boxes on a grid, with apps wired beneath.
The whole organisation. Twenty-four repositories, every workflow in each, and the apps and bots wired into them, on one grid. This is the picture nobody had.
A triage page listing repositories with open pull requests to review, grouped by product and plugin.
What moved in the last 24 hours. Every repository with something to review, and what it is. The open PRs, their checks, and the plugins they touch. The ones with nothing to do say so.
A table of zizmor security findings across repositories, with a coverage summary below it.
Findings across the organisation. zizmor runs offline over the workflow YAML already on the grid. Every finding lands attached to its workflow, and the workflows the scanner could not read are listed as unknown, not clean.
A workflow YAML file with a security finding highlighted on a line and explained in the right margin.
A workflow file, findings in the margin. One workflow file with every finding marked on the source and called out alongside it, Tufte-style. The workflow’s anatomy is drawn beneath.
A single security finding page with the workflow's anatomy graph and guidance on what to change.
One finding, in context. Title and verdict, the workflow’s anatomy, what to change, and whether it matters here, given what the grid knows about the repository.
A workflow anatomy graph of jobs and steps, with a table of recent runs below.
Anatomy of a workflow. Jobs ranked over what they need, steps inside each, artifacts to the side, and the recent runs beneath with elapsed time against the usual.
A table of collectors and schedules with run state and last-run summaries.
The plumbing. Collectors and their schedules. What reads GitHub, how often, when it last ran, and what it brought back.
01 / 08

Why

Nobody actually knows what it is.

Building, maintaining, and securing a modern CI/CD system is complicated, and the complexity is the bad kind: it isn’t in one place. It’s strewn across workflow files, branch rulesets, environments, org settings, the bots and apps wired into your repos, the third-party services they talk to — and don’t get me started on PATs.

No single screen shows you all of it, so nobody actually knows what it is. That’s the worst of all worlds, and it sits on the most critical of critical paths: the one that ships your software.

What git-serious does

Your CI/CD system, on the grid.

  1. Pulls your running CI/CD system onto the grid

    Repos, pipelines, runs, rules, apps, credentials, and the relationships between them, as one connected picture.

  2. Presents exactly the pages, views, and affordances you need

    Built to be read by people, and by the agents working alongside them.

  3. Tracks how configuration and operations change over time

    So “what changed?” is a question with an answer.

  4. Enables automated, agent-driven security review

    Finds issues and helps you fix them.

  5. Does all of it with down-scoped, read-only access

    It observes your system. It can never be the thing that breaks it.

Running it

Three steps, when it’s ready.

  1. Clone the repo.
  2. Run the install / configure skill.
  3. Tailor it to your liking.

Not yet. Nothing here is installable yet. The roadmap lives in the repo’s milestones. See the milestones ↗

Key concepts

Master your CI/CD system instead of being mastered by it.

Master complexity

git-serious distills what you actually need to know, so you can master your CI/CD system instead of being mastered by it.

Software as a sophisticated beanbag

Adjust it yourself. Your own plugins add pages, views, collectors, whatever you need to understand your system. git-serious ships with GitHub Actions; extending it to another forge, or to the particular shape of your pipeline, is what it’s built for.

The grid

Underneath is the data model at the heart of the Analogy Platform. It tracks, associates, and presents the pieces of your system the way you, and your agents, need to see them.