PreviewYou're previewing CTO AI Forge. Sign in to use it.Sign in
← All lessons
L4 · Agentic engineering: agents in CI/CD, guardrails, quality and security9 min read

Agents in CI/CD: pipelines that generate, verify and retry

The most reliable way to use coding agents at scale is not a chat window but a pipeline: the agent proposes changes, your existing CI verifies them, failures feed back to the agent, and humans review what passes.

The pattern

  1. Scope the task into many small, independent units (files, modules, services).
  2. Give rich context: examples of good conversions, style rules, related files.
  3. Generate a change per unit.
  4. Verify automatically: build, type-check, lint, run tests.
  5. Retry with feedback: send the errors back and try again, with a cap on attempts.
  6. Escalate units that still fail to a human.
  7. Review and merge in small batches with a named approver.

A real example: Airbnb's test migration

Airbnb used an LLM-driven pipeline to migrate nearly 3,500 React component test files from Enzyme to React Testing Library in six weeks, against an original estimate of 1.5 years of engineering time (InfoQ, March 2025). The pipeline ran each file through steps — convert, fix Jest test failures, fix lint, fix TypeScript errors — and retried on failure. About 75% of files migrated automatically in the first hours; after tuning, roughly 97% were done automatically, with the rest finished by hand using the LLM output as a starting point. Prompts grew to 40,000–100,000 tokens, pulling in up to 50 related files. A notable lesson: retrying with feedback mattered more than perfect prompt engineering.

Agents triggered from CI

Coding agents can also be triggered by events: an issue label, a failing build, a dependency alert. Each trigger should have an owner, a scope (which repositories, which paths), a cost cap and a clear handoff — a pull request, never a direct push to protected branches.

Guardrails specific to pipelines

  • Agents use their own service identities with the minimum repository permissions.
  • Secrets are not exposed to agent steps that process untrusted content.
  • Agent PRs are labelled and go through the same required checks as human PRs.
  • Run counts, tokens and failures are logged and visible.

What this means for the CTO

Treat agent pipelines as production systems: owned, versioned, monitored and cost-capped. Your existing CI is your most important AI safety asset — it is the automatic verifier that makes agent output trustworthy.

Start with one backlog migration or maintenance programme, measure time saved and defects introduced, and turn the pipeline into a reusable platform capability for other teams.

And make sure agent pipelines have an off switch and a run log that someone reviews: a pipeline that quietly opens hundreds of low-quality PRs costs reviewer time and trust, even if nothing breaks in production.

Diagram

Agents in CI/CD: pipelines that generate, verify and retry

Real example

InfoQ reported (March 28, 2025) that Airbnb migrated nearly 3,500 React test files from Enzyme to React Testing Library in six weeks using an LLM-driven pipeline, against an original estimate of 1.5 years; 75% of files migrated automatically within hours and about 97% in total, with prompts of 40,000–100,000 tokens drawing on up to 50 related files. Source: InfoQ — Airbnb uses LLMs to migrate 3.5K test files in six weeks (Mar 28, 2025) ↗ · Airbnb Engineering — Accelerating large-scale test migration with LLMs ↗

Use it

Quick check · 3 questions

  1. 1.What makes agent output trustworthy in a pipeline?

  2. 2.What did Airbnb find mattered more than perfect prompts?

  3. 3.How should a CI-triggered agent deliver changes?

0 of 3 answered

Sources

Last reviewed 2026-10-01.