Under Settings → DevOps you connect your CI/CD providers to FixControl. Once connected, FixControl receives that host's deployment and pipeline events, verifies their signature, scores each one for risk through the policy engine, and writes an immutable log.
Observe-and-govern by default. For most providers FixControl scores and logs your deployments — it does not trigger or roll anything back on its own. The one execution path today is Argo Rollouts promotion, and it runs only after a human approves a deployment gate, where Argo is configured for it. There is no autonomous deploy: nothing promotes without a recorded human decision, and the promotion itself is audited.
This is an admin surface (the Admin role, plus platform admins) and is scoped per tenant.
How a connection works
A connection is the binding between one CI/CD host and your tenant. Each connection has a kind that determines how it authenticates and how its webhooks are verified:
| Kind | Example | How you connect |
|---|---|---|
| GitHub App | GitHub Actions | Install the FixControl GitHub App — verified by an App-level secret, no per-tenant secret to copy. |
| OAuth app | GitLab CI | Connect over OAuth (reuses your existing GitLab connection) + project ID. |
| Manual | Jenkins, Azure DevOps, Argo CD, Vercel, Terraform Cloud, Kubernetes | FixControl mints a webhook secret shown once; you set it on the host's webhook. |
All eight providers are available for observe-and-govern. Each connection shows its live status:
not connected → connecting → connected → degraded → invalid credentials → revoked
- Degraded — connected, but the last event errored (transient).
- Invalid credentials — a permanent auth failure (token revoked / app uninstalled).
- Revoked — you disconnected it; webhooks are refused and stored credentials cleared.
The providers
| Provider | Kind | Webhook verification | How you connect |
|---|---|---|---|
| GitHub Actions | GitHub App | HMAC-SHA256, App-level secret | Install the GitHub App |
| GitLab CI | OAuth | Shared token (X-Gitlab-Token) | Connect GitLab (OAuth) + project ID |
| Jenkins | Manual (legacy) | HMAC-SHA256 (X-FixControl-Signature) | Manual + Notification webhook |
| Azure DevOps | Manual | HTTP Basic auth (password = secret) | Manual + Service Hook |
| Argo CD | Manual | Bearer token (Authorization: Bearer) | Manual + notifications webhook |
| Vercel | Manual | HMAC-SHA1 (x-vercel-signature) | Manual + Vercel webhook |
| Terraform Cloud | Manual | HMAC-SHA512 (X-TFE-Notification-Signature) | Manual + Run notification |
| Kubernetes | Manual | HMAC-SHA256 + X-FixControl-Account (cluster ID) | Manual + rollout forwarder |
Connecting a provider
The shape is the same for every provider:
- Open Settings → DevOps and pick the provider.
- GitHub: click Install GitHub App. GitLab: click Connect GitLab and enter the numeric project ID. Manual: enter the instance/job identifier (and optionally an API token).
- For a manual (or GitLab) connection, FixControl shows a webhook secret — copy it now, it's shown only once.
- Paste the webhook URL (shown on the card) into the host's webhook settings, and set the secret in the right field/header (the card gives the exact per-provider hint).
- Run a real pipeline or deploy. The connection lists recent governed runs as soon as the first one arrives.
The webhook URL only appears once a public origin is configured on the server (PUBLIC_ORIGIN or an equivalent variable). Without a public URL, a host can't reach FixControl.Example: GitLab CI
- In FixControl → Settings → DevOps → Connect GitLab, enter the project ID. Copy the shown secret.
- In the GitLab project → Settings → Webhooks: add the webhook URL, paste the secret as Secret token, and enable Pipeline events + Deployment events.
Example: Jenkins (legacy)
Jenkins has no signed-webhook standard, so FixControl verifies an HMAC you configure on a Notification webhook yourself. Prefer GitHub or GitLab where available. If you do use Jenkins: fill the Jenkins form, copy the secret, and have Jenkins POST the build JSON with the header X-FixControl-Signature: sha256=<HMAC of the body>.
The exact steps for the remaining providers (Azure DevOps, Argo CD, Vercel, Terraform Cloud, Kubernetes) follow the same pattern: connect manually, copy the one-time secret, and wire the host's webhook to the shown URL with the header from the card hint. If you need deeper setup help for a specific host (scopes, local testing through a tunnel), reach out via /contact.
What you see after connecting
- On the connection card: the connected account, scopes, webhook health (last event, count, last error), and the Rotate secret and Disconnect actions.
- Under Operations (AI operations governance): governed CI/CD activity, the risk distribution, the infrastructure risk heatmap, and the approval queue. Each event gets an outcome — Auto, Draft only, Approval required, or Blocked — according to your policy.
Security
- Encrypted at rest — tokens and webhook secrets are stored encrypted (per-tenant key envelope). The API exposes only booleans (has secret yes/no); a freshly minted secret is shown exactly once.
- Signature-first — the webhook route refuses any payload that doesn't verify (
401) and audits it as a rejected event. - Tenant isolation — every table is fail-closed RLS; inbound webhooks resolve the tenant safely before anything is written.
- Admin-only — connect, disconnect, and rotate secret require
settings.edit. - Full audit trail — connect, disconnect, secret rotation, and every accepted and rejected event are hash-chained.
- No autonomous execution — ingestion never triggers an outbound action. The only execution path, Argo Rollouts promotion, runs solely after a human approves a deployment gate (where configured) and is itself hash-chained into the audit trail.
Roadmap
Human-approved Argo Rollouts promotion is live today — an approved deployment gate promotes a paused rollout where Argo is configured (direct API or git-promote). Extending approval-gated execution, and abort/rollback, to more CI/CD providers is on the roadmap. See Governance & policy for how events are scored for risk.
See also: Integrations overview · Governance & policy · Security & audit.