💡 Cross-Repo Standards Drift Detection via Multi-Repo Analysis

[github-actions[bot]]

Summary

Implement automated detection of downstream breakage when org-wide standards, reusable workflows, or shared configurations in .github are modified. This could use CodeRabbit's Macroscope multi-repo analysis (launched March 2026) and/or a lightweight custom CI checker that validates all consumer repos against proposed .github changes before merge, preventing the org-wide outages that have already occurred.

Market Signal

CodeRabbit launched Macroscope in March 2026 — when a PR changes a shared API, type definition, or workflow, it automatically checks linked repositories for downstream breakage. GitHub's reusable workflow ecosystem continues to grow, but cross-repo impact analysis remains an unsolved problem for most orgs. The industry trend toward multi-repo monorepo-like tooling (Nx, Turborepo, Bazel) reflects growing demand for cross-repo consistency guarantees.

User Signal

PR #268 (merged May 13) fixed an org-wide failure of pr-review-mention caused by a stale v1 tag — a cross-repo breakage that affected all consumer repos. PR #302 tracked per-workflow version tags in the stub checker, showing awareness of version drift. Multiple Fleet Monitor issues (#329, #330, #331, #334) track workflow health across repos, confirming cross-repo observability is a priority. The deploy-standard-workflows.sh script pushes changes to all repos but has no pre-merge impact analysis.

Technical Opportunity

The org already has deploy-standard-workflows.sh that knows which repos consume which workflows. The compliance-audit.sh checks for workflow stub presence and version alignment. CodeRabbit Macroscope (if available on the current plan) provides out-of-the-box multi-repo impact analysis. Alternatively, a CI job on .github PRs could clone consumer repos and validate their workflow caller files against proposed reusable workflow changes — checking inputs, secrets, and permissions compatibility.

Assessment

Dimension	Score	Rationale
Feasibility	high	deploy-standard-workflows.sh already maps repo→workflow relationships
Impact	high	Prevents org-wide workflow outages (PR #268 was a real incident)
Urgency	med	Fleet Monitor provides detection; this adds prevention

Adversarial Review

Strongest objection: petry-projects has only 8 repos, most with different tech stacks. Cross-repo breakage from .github changes is rare enough that manual testing suffices. CodeRabbit Macroscope may have additional licensing costs.
Rebuttal: Cross-repo breakage HAS occurred — PR #268 fixed an org-wide failure. The org deploys reusable workflows consumed by ALL downstream repos; any change to agent-shield-reusable.yml, dependabot-automerge-reusable.yml, or dev-lead.yml affects every consumer. Fleet Monitor issues prove this is not hypothetical. A lightweight pre-merge validation CI job prevents hours of debugging broken workflows across 8 repos at the cost of one additional CI step.

Suggested Next Step

Add a CI job to the .github repo's ci.yml that, on PRs modifying reusable workflows, clones each consumer repo and validates their workflow caller files still reference valid inputs/secrets/permissions against the proposed reusable workflow changes.