--- title: How to Use CI as Your Agent Loop | daily.dev description: Using CI pipelines as agent loops for AI-assisted coding is explored through a practical setup where an AI agent iterates on a pull request until all pipeline... canonical: https://daily.dev/posts/how-to-use-ci-as-your-agent-loop-pt7mkmvr1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Use CI as Your Agent Loop | daily.dev og:description: Using CI pipelines as agent loops for AI-assisted coding is explored through a practical setup where an AI agent iterates on a pull request until all pipeline... og:url: https://daily.dev/posts/how-to-use-ci-as-your-agent-loop-pt7mkmvr1 og:image: https://api.daily.dev/og/posts/PT7mkmVr1.png og:image:alt: How to Use CI as Your Agent Loop og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Use CI as Your Agent Loop **[Atomic Spin](https://daily.dev/sources/atomicobject)** · 7 min read · 1 upvotes · 0 comments ## Summary Using CI pipelines as agent loops for AI-assisted coding is explored through a practical setup where an AI agent iterates on a pull request until all pipeline checks pass. The approach involves building a longer, stricter-than-usual CI pipeline with orthogonal, deterministic steps: compilation, secrets scanning (Gitleaks/Trivy), linting (ESLint/Biome), unit/integration/E2E tests, schema migration checks, dependency security scanning (OSV-Scanner), quality checks (SonarQube, cognitive complexity), container builds, infrastructure security, and a final LLM code review step. Three guiding principles are outlined: orthogonal steps, deterministic checks, and linear ordering with faster checks first. The agent drives fixes via the GitHub CLI, iterating until the pipeline is green, freeing developers to focus on higher-level concerns. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What order should checks be arranged in a CI pipeline designed for an autonomous coding agent to iterate on? Checks should run from fastest and most deterministic to slowest and most complex, so the agent focuses on one problem at a time. A recommended order is compilation/type check, secrets check, linting/formatting, unit tests, integration tests, browser/E2E tests, schema migration dry-run, dependency security scan, quality check, container build check, infra security check, then LLM code review last. _daily.dev surfaces practical patterns like this for teams wiring coding agents into their CI pipelines._ ### Which tools can I use to scan a web app's dependency lockfiles for vulnerabilities in a CI pipeline? OSV-Scanner is a recommended tool for scanning package lockfiles for known vulnerabilities and failing the build if any are found, which is especially important given ongoing npm package hijacking incidents. Fixing some findings can require substantial application changes, so this step should only be included if the agent is trusted to make larger surgical fixes. _developers hardening dependency checks against supply chain risk can find tool comparisons like this on daily.dev._ ### Why should the model used for automated LLM code review be different from the model that wrote the code? Using a different, reasonably priced model for code review than the one writing the code improves the value of the review step, since a single model reviewing its own output is less likely to catch its own mistakes. Cursor's model was noted as a good option, though the best choice changes frequently as the landscape evolves. _daily.dev helps developers comparing coding agent and review models stay ahead as choices shift._ ## Similar posts on daily.dev - [Where Do AI Agents Fit in CI/CD Pipelines?](https://daily.dev/posts/where-do-ai-agents-fit-in-ci-cd-pipelines--vpq7jfzjw) · Spacelift · 14 upvotes · 2 comments - [Continuous AI in practice: What developers can automate today with agentic CI](https://daily.dev/posts/continuous-ai-in-practice-what-developers-can-automate-today-with-agentic-ci-bq4ihvy3k) · GitHub Blog · 2 upvotes · 0 comments - [Continuous integration and continuous delivery for agentic AI](https://daily.dev/posts/continuous-integration-and-continuous-delivery-for-agentic-ai-lhegkveiq) · Red Hat Developer · 5 upvotes · 0 comments - [Agentic CI with Buildkite: Three practical examples](https://daily.dev/posts/agentic-ci-with-buildkite-three-practical-examples-nrbkkpbuy) · Buildkite · 2 upvotes · 0 comments --- Tags: [#testing](https://daily.dev/tags/testing), [#ai-agents](https://daily.dev/tags/ai-agents), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/how-to-use-ci-as-your-agent-loop-pt7mkmvr1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Use CI as Your Agent Loop","url":"https://daily.dev/posts/how-to-use-ci-as-your-agent-loop-pt7mkmvr1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-use-ci-as-your-agent-loop-pt7mkmvr1"},"datePublished":"2026-07-31T12:02:37.852Z","dateModified":"2026-09-13T20:43:37.073Z","description":"Using CI pipelines as agent loops for AI-assisted coding is explored through a practical setup where an AI agent iterates on a pull request until all pipeline...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b6e894a335b338f4e475b709f6627cc5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b6e894a335b338f4e475b709f6627cc5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Atomic Spin","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Atomic Spin","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e2af5ce3adaa403a8cf029268b62419f","url":"https://daily.dev/sources/atomicobject"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-use-ci-as-your-agent-loop-pt7mkmvr1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"testing,ai-agents,cicd,github-actions","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Atomic Spin","item":"https://daily.dev/sources/atomicobject"},{"@type":"ListItem","position":3,"name":"How to Use CI as Your Agent Loop"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-use-ci-as-your-agent-loop-pt7mkmvr1#faq","mainEntity":[{"@type":"Question","name":"What order should checks be arranged in a CI pipeline designed for an autonomous coding agent to iterate on?","acceptedAnswer":{"@type":"Answer","text":"Checks should run from fastest and most deterministic to slowest and most complex, so the agent focuses on one problem at a time. A recommended order is compilation/type check, secrets check, linting/formatting, unit tests, integration tests, browser/E2E tests, schema migration dry-run, dependency security scan, quality check, container build check, infra security check, then LLM code review last. daily.dev surfaces practical patterns like this for teams wiring coding agents into their CI pipelines."}},{"@type":"Question","name":"Which tools can I use to scan a web app's dependency lockfiles for vulnerabilities in a CI pipeline?","acceptedAnswer":{"@type":"Answer","text":"OSV-Scanner is a recommended tool for scanning package lockfiles for known vulnerabilities and failing the build if any are found, which is especially important given ongoing npm package hijacking incidents. Fixing some findings can require substantial application changes, so this step should only be included if the agent is trusted to make larger surgical fixes. developers hardening dependency checks against supply chain risk can find tool comparisons like this on daily.dev."}},{"@type":"Question","name":"Why should the model used for automated LLM code review be different from the model that wrote the code?","acceptedAnswer":{"@type":"Answer","text":"Using a different, reasonably priced model for code review than the one writing the code improves the value of the review step, since a single model reviewing its own output is less likely to catch its own mistakes. Cursor's model was noted as a good option, though the best choice changes frequently as the landscape evolves. daily.dev helps developers comparing coding agent and review models stay ahead as choices shift."}}]} ```