Security Migration Flow Map

How the pieces of a security-pipeline migration across about a hundred repositories fed each other: what each agent read, what it handed on, and where an edge case looped back into the rules. Click a box to see its inputs and outputs, or play the flow step by step.

Slack and GitLab are the two systems everything reads from or writes to. Solid arrows are hand-offs; dashed orange arrows are the feedback loop where an edge case found in a real repo became a new rule in the playbook.

What the watchers did

51 small background scripts did the waiting and checking, so nobody had to refresh GitLab. They only read and reported; the one thing they were allowed to do was retry a job once.

  1. Waited for rebases to finishbefore trusting any pipeline result
  2. Followed each MR's pipelinethe one for its latest commit, job by job, until green or failed
  3. Retried runner failures oncea job that died on the runner itself, not on the code (3 MRs)
  4. Checked the reported image is the real oneimage pushed by the build = image announced to the scanner (caught 5 repos reporting test images)
  5. Held approved Slack messagessent a team's message only once all its MRs were green (two teams)
  6. Checked the first pipeline after mergethe scanner said "Scanning image" with the right arch

How each repo's fix was chosen

Before writing anything, each group agent reviewed every repo in its group (CI file, bake file, the legacy scan job) and walked these questions to decide which change it actually needed. Across the 91 MRs, that meant reusing our shared CI template's report job in 59, only removing the old job in 23, and writing the report logic inline in 7 where the template couldn't be used.

Every group agent asked these questions in order for each repo. Several rows exist because a real repo broke the earlier version of the rules; the example on the right is the repo that taught us.

The pains, phase by phase

18 pains across 5 phases · expand to see them

Every problem we hit, in the order we hit it. Click one to see what we saw, what we found, what we did and the rule it left behind, lit up on the map above.

    Totals for the whole migration: 96 repos audited, 12 agents, 51 background script jobs, 91 MRs. Company, team, repo and channel names are changed.