Skip to main content

Configure the CI drift check

Goal: fail a pull request when an agent's tests exercise a call its manifests don't declare, with the exact offending edge named in the PR.

1. Record an edge trace while your tests run​

agentic-auth drift record --out edge-trace.json -- pytest -q

This runs your existing test suite unchanged, with the sidecar (in observe mode, or enforcing — either works) recording one event per decided call. Recording happens after the outcome is already fixed, so it can never change what was enforced. The command exits with your tests' own exit code; the trace is written either way.

2. Check the trace against your manifests, offline​

agentic-auth drift check --manifest ./manifests --trace edge-trace.json --format github

This runs the same edge-classification rule the PDP runs at request time — no network call, no dependency on the control plane being up — over the manifests on disk. It exits 0 (pass), 1 (drift found), or 2 (could not run, e.g. a malformed trace).

3. Wire it into GitHub Actions with the bundled action​

.github/workflows/drift-check.yml
name: drift-check
on: [pull_request]
jobs:
  drift:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: "3.12" }
      - run: pip install -e ./backend
      - run: agentic-auth drift record --out edge-trace.json -- pytest -q backend/tests
      - uses: ./actions/drift-check
        with:
          manifests: |
            backend/examples
          trace: edge-trace.json

The action writes a step summary and one annotation per undeclared edge, naming exactly which manifest would need to change — not a generic "drift detected" message.

4. Decide whether drift should fail the build​

fail-on-drift: "false" reports the result via the action's outputs without failing the step — useful while first rolling this out against an existing agent. Leave it at the default ("true") once you're ready to enforce it. A trace that could not be checked (malformed, missing) always fails the step regardless of this setting — a check that didn't run is never reported as a pass.