Cheat notes · Module 03 · Source and pipeline
AI agents in CI
A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.
The idea
Separate untrusted instructions from the tools and rights an agent can reach. The agent has read-only access and an allowlisted tool belt; a separate job applies only validated output.
Remember
- Surface: The stand-in follows ACTION lines deterministically. It runs only in the learner repository.
- Trust: Model output is input from whoever controls the prompt.
- Evidence: Break it: an issue asks for an unapproved label
- Owner: keep one team accountable for the control and the retest.
Pitfalls
- A green workflow does not prove the artifact or its inputs are trustworthy.
- A policy file does not prove that the same attack path is stopped.
Commands
./scripts/validate.sh | Check the evidence files are present without running learner code. |
git log --oneline -5 | Trace recent changes that may affect the path. |
Test yourself
Answer in your head first, then open the answer.
What is the objective?
The stand-in follows ACTION lines deterministically. It runs only in the learner repository.
What do you test?
Use the deterministic local stand-in against a harmless issue fixture, then remove its write access and secret, and validate its output in a model-free job.
What proves the control holds?
The agent has read-only access and an allowlisted tool belt; a separate job applies only validated output.
Where module 03 leaves you: The agent has read-only access and an allowlisted tool belt; a separate job applies only validated output.