pipelineconductor

PipelineConductor

Orchestrate and harmonize multi-repo CI/CD pipelines with policy-driven automation.

PipelineConductor is a tool for managing CI/CD pipeline consistency across hundreds of repositories. It scans repositories, evaluates them against Cedar policies, generates compliance reports, and can automatically remediate violations.

Features

Core

• 🏢 Multi-org scanning: Scan repositories across multiple GitHub organizations
• 📜 Policy-as-code: Define CI/CD policies using Cedar
• ⚙️ Profile system: Named configurations for different project types (default, modern, legacy)
• 📊 Compliance reports: Generate JSON, SARIF, Markdown, CSV, and HTML reports

Compliance Checking (v0.2.0)

• ✅ Reference repo matching: Check workflows against a reference repository
• 📁 Local filesystem scanning: Scan repositories without GitHub API
• 🤖 GitHub Action: Reusable action for CI/CD integration
• 🔧 Automated remediation: Generate missing workflows from templates
• 📈 Dashboard generation: Dashforge integration for visual compliance dashboards

Installation

go install github.com/plexusone/pipelineconductor/cmd/pipelineconductor@latest

Or build from source:

git clone https://github.com/plexusone/pipelineconductor.git
cd pipelineconductor
go build -o pipelineconductor ./cmd/pipelineconductor

Quick Start

1. Set your GitHub token:

export GITHUB_TOKEN=ghp_your_token_here

1. Scan your organization for policy compliance:

pipelineconductor scan --orgs myorg --output report.json

1. Check workflow compliance against a reference repository:

pipelineconductor check --orgs myorg --ref-repo plexusone/.github

Usage

Scan Command

Scan repositories for policy compliance:

# Basic scan
pipelineconductor scan --orgs myorg

# Multiple organizations
pipelineconductor scan --orgs org1,org2,org3

# Filter by language
pipelineconductor scan --orgs myorg --languages Go,Python

# Output to file
pipelineconductor scan --orgs myorg --output report.json --format json

Check Command

Check workflow compliance against a reference repository:

# Check organization repos against reference
pipelineconductor check --orgs myorg --ref-repo plexusone/.github

# Check with strict mode (require exact reusable workflow matches)
pipelineconductor check --orgs myorg --ref-repo plexusone/.github --strict

# Check local repositories
pipelineconductor check --local ~/projects --ref-repo plexusone/.github

# Output as HTML report
pipelineconductor check --orgs myorg --ref-repo plexusone/.github -f html -o report.html

Configuration File

Create ~/.pipelineconductor.yaml or .pipelineconductor.yaml:

github_token: ${GITHUB_TOKEN}
orgs:
  - myorg
  - otherorg
profile: default
verbose: true

GitHub Action

Use PipelineConductor in your CI/CD pipeline:

- name: Check Compliance
  uses: plexusone/[email protected]
  with:
    ref-repo: 'plexusone/.github'
    orgs: 'myorg'
    format: 'markdown'

Profiles

PipelineConductor uses profiles to define expected CI/CD configurations:

Documentation

Full documentation is available at plexusone.github.io/pipelineconductor

• CLI Reference
• Policy Writing Guide
• GitHub Actions Integration
• Release Notes

Architecture

┌─────────────────────────────────────────────────────────────────┐
│                     PipelineConductor CLI                       │
├─────────────────────────────────────────────────────────────────┤
│  ┌──────────────┐  ┌──────────────┐  ┌───────────────────────┐  │
│  │  Collectors  │  │    Policy    │  │     Compliance        │  │
│  │ - GitHub API │  │    Engine    │  │ - Reference Matcher   │  │
│  │ - Local FS   │  │ - Cedar      │  │ - Workflow Generator  │  │
│  └──────────────┘  └──────────────┘  └───────────────────────┘  │
│                            │                                    │
│                    ┌───────┴────────┐                           │
│                    │   pkg/model    │                           │
│                    └────────────────┘                           │
└─────────────────────────────────────────────────────────────────┘

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines.

License

MIT License - see LICENSE for details.