Roadmap: Evolve CAST from Pipeline Generator to Continuous Governance Platform

[shenxianpeng]

Background

Current CAST provides strong value as a standardized CI/CD and compliance bootstrap tool. However, enterprise platform engineering teams often need ongoing governance rather than one-time template generation.

Proposed Enhancements

1. Drift Detection

Detect divergence between generated standards and repository reality.

Potential commands:

cast drift
cast audit

Examples:

• Workflow modifications
• Removed security scanners
• Reduced severity thresholds
• Missing required compliance controls

2. Compliance Scoring

Provide a repository-level compliance score.

Example:

Repository: 92/100

Passed:
- SAST
- SBOM
- Dependency Scanning

Missing:
- Provenance
- Artifact Signing

This would make CAST more useful for engineering managers and leadership.

3. Fleet Management

Support large-scale repository governance.

Potential commands:

cast fleet scan
cast fleet apply
cast fleet report

Use cases:

• Audit hundreds of repositories
• Roll out policy updates
• Generate organization-wide compliance reports

4. Auto Upgrade / Doctor

Provide lifecycle management.

Potential commands:

cast doctor
cast upgrade

Examples:

• Detect outdated actions
• Upgrade templates
• Recommend security improvements

5. AI Governance

Move beyond generation.

Potential commands:

cast review
cast autofix

Examples:

• Analyze CI/CD pipelines
• Detect missing controls
• Generate remediation patches
• Explain compliance failures

Long-Term Vision

Position CAST as a continuous governance platform for Platform Engineering teams rather than only a CI/CD template generator.

This could significantly increase enterprise adoption and differentiation.