Why some signals live in other repos

The platform scores each connected repository on its Agentic Foundation rubric. Some checks are about this repo: agent instructions, tests, README. A few delivery and contract checks often live somewhere else:

Signal	Normally lives in
Terraform (H5–H7: IaC, remote state, plan in CI)	A Terraform repository
Kubernetes manifests and GitOps (H3–H4)	A GitOps repository
Shared CI templates (CI on change, CI runs build, CI runs tests, CI static analysis)	A CI templates repository
API contracts owned centrally (F)	An API contracts repository

Turn on Split infrastructure, select those repos, then analyze the service. That scan reads the selected repos. It does not copy their files into the service repo.

Linked CI templates credit those four setup rows only (shown under Continuous Integration). They do not credit CI ships artifact. That row stays on Continuous Delivery. Recent pass/fail, flake, and duration are not scored here. Those live on SDLC Insights. See Four CI questions.

Where CI configuration can live

For one organization, pipeline setup is usually one of three shapes:

1. CI config lives in the service repo (for example .github/workflows/).
2. CI config lives in a separate platform repo (shared workflows or a Jenkins shared library).
3. A mix of in-repo files and a platform repo.

When the service repo has no CI config of its own, the scan uses the shared workflow catalog from the repos you selected for CI templates (.github/workflows, a root Jenkinsfile, and Jenkins shared-library files). It does not grade the rest of that repo.

Settings

Open Workspace settings → Agentic Foundation → Linked platform repositories.

The card has two parts:

• Split infrastructure. Turn this on when Terraform, GitOps, CI templates, or API contracts live outside the service repo. Leave it off to grade those checks from the service repo only.
• Four lists: Terraform, GitOps, CI templates, and API contracts. Each list is the connected repos already in Agentic Foundation scope. You can select more than one repo per role. Each list has its own search. Search, check a repo, then search again for the next one. Repos you already checked stay selected.

A service analysis reads the repos selected for each role. A platform repo’s own Analyze scores that repo only. It does not write credit for other services.

A service can name extra paths in AGENTS.md under ## Linked platform context. Those paths apply only to that service, and only when the repo is already selected. A Terraform repo organized by environment still counts for infrastructure as code, remote state, and plan in CI when no file is named after the service.

If a selected repo cannot be read (the GitHub App cannot access it, or the lookup hits a limit), those checks are left out of the dimension percent. They are not scored as a gap.

Evidence on the CI setup rows

On Continuous Integration, for CI on change, CI runs build, CI runs tests, and CI static analysis, a Met or Partial shows Evidence used:

• This repository, when in-repo CI config contributed.
• Linked platform repository, when the CI templates selection contributed. The chip names the platform repo (owner/name).

A workflow file that is only a stub (no real on: trigger and jobs:) makes CI on change Partial, never Met. That stub does not force the build, test, or static analysis rows to Gap.

What Improve this scan can suggest

Improve this scan can point at CI setup or at live health. It does not add a recent CI health row to Agentic Foundation.

• Link a CI templates repository when split infrastructure is on, no CI templates repo is selected, CI on change is Gap or Partial, and the service repo has no CI config. It opens Workspace settings → Agentic Foundation → Linked platform repositories.
• View CI health in Insights when CI on change is Met or Partial. It opens CI Pipeline Insights. If GitHub Actions is off, the suggestion also says to enable it so the charts have live runs. Turning Actions on does not rescore the setup rows. See GitHub Actions.

Platform repositories score differently

A repository detected as a platform repo (for example, a dedicated terraform repo) gets a Platform repository badge. Its headline score reflects the criteria that apply to that kind of repo. You should not compare its percentage directly against an application service’s percentage.

Not applicable vs gap

• Not applicable (N/A): the criterion does not apply to this kind of repository.
• Gap: the criterion applies and the evidence is missing from the files the scan read.
• Left out of the percent: a selected platform repo could not be read. Those checks are omitted until a later scan can read them.

Remediation export

An all-dimension export can include CI, CD, and API contract sections when those roles have selected repos. A single-dimension export includes only the matching section (Continuous Integration, Continuous Delivery, or API Contracts). Other dimensions omit the block. The export tells the agent to add those sections to AGENTS.md when they are missing, and not to copy platform files into the service repo. See How to use the exported remediation file.