POC: Secure and governed modernization pipeline using GitHub Actions + Copilot CLI #11

Build a proof of concept in eShopOnWeb for a secure, governed, and auditable app modernization pipeline using:

• GitHub Actions for orchestration

• GitHub Copilot CLI for sequential agentic stages

• one working branch

• one final PR

• no intermediate PRs

This POC should demonstrate both:

• technical feasibility, and

• a control model that can be reviewed by InfoSec / platform governance.

Objectives

• Prove Copilot CLI can be used in GitHub Actions for sequential modernization stages

• Keep all intermediate work on a single long-lived branch

• Avoid intermediate PR creation

• Open only one final PR after validation succeeds

• Persist machine-readable state between stages

• Capture audit evidence for each stage

• Demonstrate a secure and governed execution model suitable for InfoSec review

Scope

In scope

• GitHub Actions orchestration

• Sequential Copilot CLI invocations

• Branch-based accumulation of changes

• Validation gates between stages

• Logging, artifacts, and execution evidence

• Security/governance documentation for the POC

Out of scope

• Full app modernization in the first pass

• Parallel agent execution

• Use of GitHub-hosted Copilot cloud/coding agent

• Org-wide rollout beyond this repo

• Solving every platform standardization concern in phase 1

Proposed workflow

• Create a workflow that can be manually triggered

• Create a working branch for each run (example: modernization/run-<run_id>)

• Initialize a state directory (example: .github/modernization/)

• Run an Inventory stage

• Run a Plan stage

• Run a Transform stage

• Run a Remediate stage

• Run a Validate stage

• Generate a final summary / PR body

• Open one final PR only if all required validations pass

Deliverables

Workflow and automation

• Add top-level orchestration workflow

• Add reusable Copilot CLI stage workflow or script wrapper

• Add prompt files for each stage

• Add validation scripts for each stage

• Add PR synthesis step

State and evidence

• Add machine-readable run state file

• Add machine-readable inventory output

• Add machine-readable plan output

• Add per-stage result files

• Add final summary artifact or markdown report

• Retain logs/artifacts needed for audit and troubleshooting

Security and governance

• Document token/credential model

• Document required workflow permissions

• Document trust boundaries and runner assumptions

• Document branch protection expectations

• Document prompt/log/artifact retention approach

• Document failure handling and stop conditions

• Document auditability approach for stage actions and changes

Security and governance acceptance checks

Identity and authentication

• Define how GitHub Actions authenticates

• Define how Copilot CLI authenticates

• Ensure credentials are scoped to least privilege

• Document all required secrets and why they are needed

Authorization and permissions

• Restrict workflow permissions to the minimum required

• Prevent direct writes to protected target branches

• Limit writes to the designated modernization working branch

• Ensure PR creation occurs only at the end of a successful run

Auditability and traceability

• Capture stage logs

• Capture prompts or prompt references used per stage

• Capture validation results per stage

• Record which stage produced which changes

• Preserve enough evidence for post-run review

Data handling and secret safety

• Verify secrets are not written to logs or artifacts

• Verify prompts do not unintentionally include sensitive values

• Document retention and visibility of generated artifacts

• Document any data handling assumptions for runners and Copilot CLI usage

Operational guardrails

• Add timeout limits per stage

• Add bounded retry behavior

• Prevent infinite remediation/self-heal loops

• Define clear pipeline stop conditions

• Define acceptable blast radius for automated changes

Suggested stage outputs

• .github/modernization/run.json

• .github/modernization/inventory.json

• .github/modernization/plan.json

• .github/modernization/stages/inventory.json

• .github/modernization/stages/plan.json

• .github/modernization/stages/transform.json

• .github/modernization/stages/remediate.json

• .github/modernization/stages/validate.json

• .github/modernization/summaries/final-pr.md

Validation criteria

• Workflow can be manually triggered in eShopOnWeb

• A dedicated working branch is created

• At least 3 sequential Copilot CLI stages complete

• State is persisted between stages

• Validation runs after each material mutation

• Intermediate PRs are not created

• A single final PR is opened if validation succeeds

• Failures stop the pipeline cleanly

• Logs/artifacts are available for diagnosis and review

• Security/governance design is documented clearly enough for InfoSec review