oneport-debug-cicd

Non-interactive CI/CD failure debugger. When a build goes red, this hooks into the post-failure step of GitHub Actions, Jenkins, or GitLab CI, isolates which commit since the last green build broke it (and who owns it), runs the real failing test in a Docker sandbox, has an AI generate a root-cause analysis plus a patch, and posts it to Jira/Slack — all with zero human interaction.

The thing Claude Code structurally can't do: it can read a diff, but it doesn't know which commit in the history broke the build or what last-known-good looked like. This tool diffs the failing commit against the last green run and blames the culprit at the function level.

Try it in 60 seconds (no CI server, no API key)

pip install oneport-debug-cicd
oneport-cicd demo

The demo materializes a real two-commit git repo (green build → a commit that regresses it) and runs the real RegressionDetector over it. You'll see the failing build log, the regression analysis, and — computed live, not hard-coded — the culprit commit SHA, its author, and the exact changed function:

Likely culprit   7399dd4e  by Bob Builder
payment-service  services/payment.py:6  charge()  (blame: Bob Builder)

Add --format json for machine-readable output.

Wire it into your pipeline

The worker is non-interactive and exits 0 (ok), 1 (analysis failed), or 2 (critical — page on-call).

GitHub Actions

- name: Debug failure
  if: failure()
  run: |
    oneport-cicd-worker --platform github-actions \
      --run-id ${{ github.run_id }} --repo ${{ github.repository }} \
      --post-jira --post-slack

Jenkins

post {
  failure {
    sh 'oneport-cicd-worker --platform jenkins --build-url ${BUILD_URL} --post-jira'
  }
}

GitLab CI (needs the gitlab extra)

after_script:
  - >
    if [ "$CI_JOB_STATUS" = "failed" ]; then
      oneport-cicd-worker --platform gitlab
        --pipeline-id $CI_PIPELINE_ID --project-id $CI_PROJECT_ID
    fi

Generate and sandbox-verify a fix

oneport-cicd-worker --platform github-actions --run-id 123 --repo owner/app \
  --generate-patch --patch-output fix.patch \
  --sandbox-image python:3.11-slim

The patch is never auto-applied — it's attached to the Jira ticket for human review (SOX change-management gate). With --sandbox-image, the patched tests are re-run in an isolated Docker container (--network=none, read-only mount, memory/CPU capped) to confirm the fix before you ever see it.

Other commands

oneport-cicd analyze --platform github-actions --run-id 123 --repo owner/app  # manual trigger
oneport-cicd replay --log-file ./saved_build.log                              # re-analyze a saved log
oneport-cicd history --last 10                                                # recent analyses from the audit log

Environment variables

Optional dependencies

pip install 'oneport-debug-cicd[gitlab]'   # GitLab CI support (python-gitlab)

GitHub Actions, Jenkins, Jira, and Slack are reached over their REST APIs with httpx — no heavy vendor SDKs in the default install. The Docker sandbox shells out to the docker CLI (no Python docker SDK required).

Air-gapped / on-prem AI

Set ONEPORT_MODE=local to run the AI analysis against a local model (Ollama / vLLM) — no build logs or source leave your network. See oneport-debug-local.

License

Apache-2.0