Detector: CI CD Drift

Detector: CI/CD Drift

Detects stale file path references in GitHub Actions workflows and Dockerfiles.

Property	Value
Name	cicd-drift
Tier	DETERMINISTIC
Languages	Any (YAML/Dockerfile)
External tool	None
LLM required	No
Confidence	0.90

What it detects

Paths declared in CI/CD configuration that no longer exist in the repo:

• GitHub Actions: local action paths (uses: ./...), working-directory, path, file, entrypoint values
• Dockerfiles: COPY/ADD source paths

How it works

1. Scans .github/workflows/*.yml for local action paths and path-valued keys
2. Scans all Dockerfile* files for COPY/ADD source paths
3. Checks whether each referenced path exists on disk
4. Skips glob patterns, absolute paths, URLs, $-templated values, and --from= multi-stage COPY
5. Produces a MEDIUM severity finding for each missing path

Severity

All findings are MEDIUM — a stale path in CI will cause build failures.

Example finding

[CICD-DRIFT] .github/workflows/ci.yml (line 42)
  The working-directory reference 'build/legacy' points to a path that does
  not exist in the repository.
  Severity: MEDIUM, Confidence: 0.90

Configuration

No detector-specific config. Enable/disable via the standard mechanism:

[sentinel]
enabled_detectors = ["cicd-drift"]