RU
Get in touch
Chapter 28

Automate Only a Stable, Bounded Workflow

A non-interactive agent can't wait for a new approval or clarification the way a person in a terminal can. So a CI task must have an immutable input, narrow rights, stop conditions, a machine-readable result, and an external gate.

The documented entry points of the three products differ by mode.

Product · Read or analysis automation · Changing run

  • Codex - codex exec with a read-only sandbox; codex exec --sandbox workspace-write in an isolated checkout
  • Claude Code - claude -p with limited --allowedTools; Explicitly allowed tools, a separate environment, and deterministic gates
  • Cursor - agent -p, which without --force proposes but doesn't apply edits; agent -p --force or the --yolo alias only in an isolated environment

Two safe patterns cover most cases. A read-only reviewer: CI passes the diff, rules, and test artifacts, the agent returns findings but doesn't change the checkout or publish them without a separate step. A patch producer: the agent works in a disposable branch or VM, writes only the workspace, runs checks, and saves a patch artifact, while a separate trusted job opens the PR. A minimal pipeline puts this into shape.

SQL
checkout untrusted change into isolated workspace
load reviewed project instructions
run agent with no production credentials
allow only repository writes and required network destinations
capture structured events and final diff
run deterministic typecheck, tests, security and policy gates
start independent read-only review
publish patch or PR only from a separate trusted step

Stop conditions for an unattended run are worth setting in advance: a new secret or network destination is needed, the actual write scope is wider than the contract, the baseline doesn't reproduce, a command asks for privileged access, output is truncated, or the lockfile changed without a separate dependency task.

Don't give the agent both the code and the release key. A job that analyzes untrusted repository content must not have a production deploy token. Split generation, verification, and publication across different identities. The agent's exit code reports completion of the run, not the correctness of the patch - that's confirmed by your tests, policy checks, diff scope, and independent review.

Automation is configured. But to know whether it works, you need the right metrics - accepted changes, not the number of answers.

Links