ci: weekly infrastructure update-audit agent #34

2026-06-26T07:17:04Z

k.renner commented

2026-06-26 07:17:04 +00:00

Adds a Woodpecker cron pipeline that runs a read-only Claude Code agent to audit manually-pinned infrastructure currency, posting the report to a single persistent Gitea issue.

What it covers (complements, does not duplicate, existing automation)

Flux image-automation already bumps enrolled container tags → out of scope.
Daily security-scan agent already owns CVEs → out of scope.
This agent audits what nobody auto-tracks: Talos / Kubernetes / Flux version pins, Helm chart minor/major bumps held back by ~MAJOR.MINOR.0 constraints, images excluded from automation, and Ansible/OpenTofu dependency drift.

Design

Read-only agent: allowedTools: Read,Glob,Grep,Write,WebFetch,WebSearch — no Edit/Bash, so it can never mutate the repo. Mirrors security-scan.yml (same ci-claude image, same OAuth + Gitea-bot secrets, same stdin-pipe invocation).
Delivery: find-or-create the single "Infrastructure update audit" issue; refresh its body + add a dated comment each run.
Weekly schedule.

One-time setup after merge

woodpecker repo cron add --repo gitea_admin/homelab \
  --name update-audit --branch master --schedule '@weekly'

Uses Woodpecker's documented cron: name filter (not the injected PIPELINE var the other pipelines use) so the cron is CLI-creatable.

Notes

Reuses the security_bot_token secret (needs issues:write). Swap for a dedicated token if you want separate attribution.
e2e.yml has a bare event: cron, so it runs on every cron, including this one — a weekly e2e run will piggyback. Pre-existing property of e2e.yml.

🤖 Generated with Claude Code

Adds a Woodpecker cron pipeline that runs a read-only Claude Code agent to audit manually-pinned infrastructure currency, posting the report to a single persistent Gitea issue. ## What it covers (complements, does not duplicate, existing automation) - **Flux image-automation** already bumps enrolled container tags → out of scope. - **Daily security-scan agent** already owns CVEs → out of scope. - **This agent** audits what nobody auto-tracks: Talos / Kubernetes / Flux version pins, Helm chart minor/major bumps held back by `~MAJOR.MINOR.0` constraints, images excluded from automation, and Ansible/OpenTofu dependency drift. ## Design - Read-only agent: `allowedTools: Read,Glob,Grep,Write,WebFetch,WebSearch` — no Edit/Bash, so it can never mutate the repo. Mirrors `security-scan.yml` (same `ci-claude` image, same OAuth + Gitea-bot secrets, same stdin-pipe invocation). - Delivery: find-or-create the single **"Infrastructure update audit"** issue; refresh its body + add a dated comment each run. - Weekly schedule. ## One-time setup after merge ``` woodpecker repo cron add --repo gitea_admin/homelab \ --name update-audit --branch master --schedule '@weekly' ``` Uses Woodpecker's documented `cron:` name filter (not the injected `PIPELINE` var the other pipelines use) so the cron is CLI-creatable. ## Notes - Reuses the `security_bot_token` secret (needs issues:write). Swap for a dedicated token if you want separate attribution. - `e2e.yml` has a bare `event: cron`, so it runs on *every* cron, including this one — a weekly e2e run will piggyback. Pre-existing property of e2e.yml. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

k.renner added 1 commit 2026-06-26 07:17:04 +00:00

ci: weekly infrastructure update-audit agent eb0c44daa8

Adds a Woodpecker cron pipeline that runs a read-only Claude Code agent to
audit the components NOT covered by existing automation, and posts the report
to a single persistent Gitea issue.

Scope (complements, does not duplicate, existing automation):
  - Flux image-automation already bumps enrolled container tags.
  - The daily security-scan agent already owns CVEs.
  - This agent audits manually-pinned currency instead: Talos / Kubernetes /
    Flux versions, Helm chart minor/major bumps held back by ~MAJOR.MINOR.0
    constraints, images excluded from automation, and Ansible/OpenTofu drift.

The agent is read-only (allowedTools: Read,Glob,Grep,Write,WebFetch,WebSearch;
no Edit/Bash) so it can never mutate the repo. It writes a report to
/tmp/update-audit.md; the pipeline find-or-creates the "Infrastructure update
audit" Gitea issue and refreshes its body.

Cron uses Woodpecker's documented `cron:` name filter (rather than the injected
PIPELINE var the other pipelines use) so the schedule is CLI-creatable:
  woodpecker repo cron add --repo gitea_admin/homelab \
    --name update-audit --branch master --schedule '@weekly'

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

k.renner merged commit 4781735c9f into master

2026-06-26 07:25:10 +00:00

k.renner deleted branch update-audit-agent

2026-06-26 07:25:10 +00:00

k.renner referenced this issue from a commit

2026-06-26 07:25:11 +00:00

Merge pull request 'ci: weekly infrastructure update-audit agent' (#34) from update-audit-agent into master

claude-bot referenced this pull request

2026-09-24 15:01:14 +00:00

chore(wiki): image build.1790261926 (facts, questions, lab) #950

Sign in to join this conversation.