Actions: CI/CD monitoring

Actions watches your GitHub Actions workflow runs and turns three kinds of signal into alerts: failures (triaged by AI into a root cause and a suggested fix), flaky tests, and duration regressions. It’s an optional per-org module, off by default.

The only AI spend here is failure triage; flaky and duration detection are deterministic.

# What it detects

Every completed workflow_run is recorded (with its duration), then classified:

• Failure triage — on a failure or timed_out run, inline pulls the failed jobs’ logs (capped) and asks a model to categorize it (build / test / lint / typecheck / deploy / dependencies / infra / other), find the root cause, and propose a suggested fix with a confidence score. The result posts as a PR comment and, if configured, to Teams and email.
• Flaky tests — a run that succeeded only on a retry (attempt > 1) raises a medium flaky alert.
• Duration regressions — a successful run whose duration exceeds 1.5× the median of the last 10 successful runs (and by more than a minute) raises an alert — medium past 2×, else low.

A branch filter (empty = all branches) scopes what gets triaged.

# Alerts

Each alert has a kind (failure / flaky / duration), a stable fingerprint, a status (new / posted / dismissed / resolved), and — for failures — the category, root cause, suggested fix, and confidence. Manage them under Actions → CI alerts, where failure alerts expand to show the root cause and fix. The Overview shows a 14-day window: success rate, alerts by kind, and triage spend.

# GitHub-native security alerts

Dependabot, code-scanning, and secret-scanning alerts arrive on the same GitHub App connection, but they’re handled by Sentinel, not here — even though you might think of them as “GitHub Actions security.” Turn them on with Native alerts on the repo’s security monitor.

# Setup

Enable under Actions → Settings and choose which detectors run (failure triage / flaky / duration) and the branch filter. Webhook event: workflow_run.