# Actions: CI/CD monitoring

# Actions: CI/CD monitoring

Actions watches your GitHub Actions workflow runs and turns three kinds of signal into alerts: **failures** (triaged by AI into a root cause and a suggested fix), **flaky tests**, and **duration regressions**. It's an optional per-org module, off by default.

The only AI spend here is failure triage; flaky and duration detection are deterministic.

## What it detects

Every completed `workflow_run` is recorded (with its duration), then classified:

- **Failure triage** — on a `failure` or `timed_out` run, inline pulls the failed jobs' logs (capped) and asks a model to categorize it (`build` / `test` / `lint` / `typecheck` / `deploy` / `dependencies` / `infra` / `other`), find the **root cause**, and propose a **suggested fix** with a confidence score. The result posts as a PR comment and, if configured, to Teams and email.
- **Flaky tests** — a run that *succeeded only on a retry* (attempt > 1) raises a medium flaky alert.
- **Duration regressions** — a successful run whose duration exceeds **1.5× the median of the last 10 successful runs** (and by more than a minute) raises an alert — `medium` past 2×, else `low`.

A **branch filter** (empty = all branches) scopes what gets triaged.

## Alerts

Each alert has a kind (`failure` / `flaky` / `duration`), a stable fingerprint, a status (`new / posted / dismissed / resolved`), and — for failures — the category, root cause, suggested fix, and confidence. Manage them under **Actions → CI alerts**, where failure alerts expand to show the root cause and fix. The **Overview** shows a 14-day window: success rate, alerts by kind, and triage spend.

## GitHub-native security alerts

Dependabot, code-scanning, and secret-scanning alerts arrive on the same GitHub App connection, but they're handled by **[Sentinel](./sentinel.html)**, not here — even though you might think of them as "GitHub Actions security." Turn them on with **Native alerts** on the repo's security monitor.

## Setup

Enable under **Actions → Settings** and choose which detectors run (failure triage / flaky / duration) and the branch filter. **Webhook event:** `workflow_run`.