# February Update: CI/CD in the Agentic Era

> January at Latchkey: dashboard v2, insights you apply as a pull request or skip, and open beta pricing. Plus why CI is the last place teams let automation act, and our rules for it.

Source: https://latchkey.dev/blog/ci-cd-in-the-agentic-era  
Kaveh Alemi  
Published 2026-02-01

**TL;DR** January made dashboard v2 the default, turned insights into changes you accept or skip as one pull request, and opened the beta at $39 and $99 a month. We also lay out why CI is the last place teams let automation act, and the rules we hold ourselves to before it does.

## Shipped in January

- **Dashboard v2.** One place for runs, cost, performance and insights, filtered by the same repository and workflow selector on every page.
- **Per-job cost.** See what each job and each runner type actually costs you, priced at GitHub's new January rates.
- **Workflow runs table.** Sort and page through every run from the Performance page to find the slow and failing ones.
- **Insights you apply or skip.** Accept or skip each proposed workflow change; the ones you accept arrive as a single pull request you review and merge.
- **Real data only.** Every chart shows your organization's numbers or an empty state, never sample data.
- **Faster repository search.** Find and enable repositories quickly, even in large organizations, with monitored ones first.
- **Open beta and pricing.** Install the GitHub App and start a 30-day free trial; Launch is $39 a month and Scale is $99.
- **Support page.** Reach us from the site with a contact form, without hunting for an email address.

This update covers what reached you in January: dashboard v2 as the default, insights you accept or skip change by change, and an open beta with real prices. It also sets out where the platform is going, why CI is the last place teams let automation act, and the rules we hold ourselves to as we move further in. It ends with what is coming this month.

![Latchkey Ledger No. 02: CI/CD in the agentic era, February 2026](/blog/images/ledger-2026-02-cover.png)

## Platform core: Dashboard v2, the default

Dashboard v2 became the default on January 3, and most of January went into making it hold up with real data:

- **One filter for everything.** A repository and workflow selector sits in the top bar, so every page answers the same question for the same scope.
- **Overview.** Total runs, fail and cancel rates, average duration, mean time to recovery, the free GitHub minutes you have used this cycle, a forecast of billable cost to the end of the cycle, and the insights waiting on you.
- **Cost.** Rebuilt around what each job actually used, so a workflow's cost is the sum of its jobs and you can break it down by runner type. GitHub cut its hosted-runner prices [by up to 39% on January 1](https://github.blog/changelog/2026-01-01-reduced-pricing-for-github-hosted-runners-usage/), and per-job cost prices a standard 2-core Linux minute at the new $0.006.
- **Performance.** A workflow runs table (status, repository, workflow, branch, duration, time), sortable and paged.
- **Insights.** Priority badges, a confidence gauge and rows that expand to a preview. More on this below.
- **Repositories.** Search and scroll that stay quick in organizations with hundreds of repositories, with the ones you monitor listed first.

We also removed the sample data the dashboard could fall back to while it was being built, because it meant a chart could show numbers that were not yours. Every chart now shows your data or an honest empty state.

## Platform core: insights you apply as a PR, or skip

![Insight lifecycle: something changes in CI, Latchkey analyses it, an insight appears with priority and confidence, and you either apply it as a pull request or skip it](/blog/images/ledger-2026-02-insight-lifecycle.png)

Latchkey looks at your pipelines when something worth looking at happens: a run fails, a run costs or takes far more than usual, or someone edits a workflow file. It does not run on a timer. A weekly report that has nothing new to say trains people to ignore it, so we took ours out.

What comes back is an insight. Each one has a priority (high, medium, low) and a confidence gauge. Opening one shows your workflow file with each proposed change inline, at the line it touches. There are two kinds:

- **Code-change insights** get two buttons: **Skip this** or **Apply with latchkey**.
- **Best-practice insights**, where there is nothing to apply automatically, get **Not relevant** or **I've done this**.

You decide per change. When you click apply, every change you accepted goes into one branch, one commit and one pull request against your default branch. The PR description says what changed and what we expect it to save in time and money. Then it is yours: you review it, you merge it or you close it.

Nothing is pushed to your default branch and nothing is merged on your behalf. Our documentation puts it in one line that I would like to keep true forever: you create the PR, you review the PR, and you merge the PR. The diff is also the backstop: if Latchkey ever places a change badly, you see it there before it touches anything.

## Open beta, pricing and teams

**The beta opened on January 19.** Anyone can install the GitHub App, pick repositories and get a dashboard. Latchkey pulls this month's run history for the repositories you enable, which takes a few minutes, and the first analysis starts once that is done. We read CI metadata and workflow files. We do not read your source code, secrets, environment variables, issues or PR discussions.

**The free trial is 30 days**, down from three months. Most people know within a week whether a CI dashboard tells them something new, and a 90-day trial mostly postpones the question of whether it is worth paying for.

**Prices were set on January 22:**

![Open beta pricing: Launch $39/month, Scale $99/month, Enterprise custom, with seat allowances from the teams release](/blog/images/ledger-2026-02-pricing.png)

Plans are priced by monitored repositories, with unlimited workflows in each; only repositories you actively monitor count against the limit. Above 40 repositories it is a conversation.

**Seats are coming.** Last month I wrote that we would add teams "without per-seat pricing". We changed our minds. Flat pricing avoids taxing sharing, but a one-person team and a twenty-person team watching the same ten repositories get very different value from it, and one price either overcharges the first or undercharges the second. So each plan includes seats, and extra seats are $5 a month.

## Platform vision: CI becomes the gate

The bet from the first issue has not changed: CI has to act, not only report. January made the reason sharper.

More of the code reaching the pipeline now comes from agents, and it arrives faster than people can babysit red builds. That turns CI from a convenience that runs your tests into the gate between machine output and your main branch. A gate that waits for a person every time a runner is missing a tool, or a registry has a bad minute, becomes the bottleneck of the whole loop. The agent is fast; the person unblocking it is not.

So the direction for Latchkey is to move from watching pipelines to taking part in them. Everything we shipped in January still watches from outside: it reads what happened, prices it, and proposes a change you can review. That is the right starting point, and it is also a ceiling. Some of the most common reasons a job goes red are problems of the environment the job ran in, and you cannot repair an environment you only ever see in a log after the fact.

We believe the product that wins CI in the agent era is the one teams trust to act, and that trust is earned in order, not declared. The next two sections are why teams are cautious today, and the ladder and rules we are using to earn it.

## The trust gap

Almost everyone who writes software now uses AI to do it. The [2025 DORA report](https://cloud.google.com/blog/products/ai-machine-learning/announcing-the-2025-dora-report) found 90% of respondents using AI at work, and 30% reporting little or no trust in the code it generates. In the [2025 Stack Overflow Developer Survey](https://survey.stackoverflow.co/2025/ai), 84% use or plan to use AI tools, more developers distrust the accuracy of those tools (46%) than trust it (33%), and the task developers most often say they do not plan to hand to AI is deployment and monitoring: 76% don't plan to.

People let AI write the code and keep it out of the pipeline that decides whether the code ships. I don't think that is irrational, for two reasons.

**A wrong action in CI is expensive and quiet.** A pipeline that retries a failing test until it passes produces a result that looks exactly like a real pass. Automation that makes a green check mean less is worse than none.

**The pipeline is where the keys are.** CI jobs hold deploy credentials, package tokens and cloud keys. In March 2025 the widely used `tj-actions/changed-files` action was compromised: its version tags were repointed to a malicious commit that printed CI secrets into workflow logs ([CISA alert](https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066-and-reviewdogaction), [GitHub advisory](https://github.com/advisories/ghsa-mrrh-fwg8-r2c3)). Nobody chose to trust that code; it came in through a tag everyone assumed was fixed. Automation that acts inside a pipeline asks for that level of access, and teams are right to make it earn it.

One more hazard: a merged Latchkey PR is itself a workflow change, so we make sure our own pull requests never set off another round of analysis. Automation that feeds on its own output is the first failure to guard against as more commits come from agents.

## The trust ladder and our rules

So the question is how automation earns the right to act in the pipeline. We think of it as a ladder:

![The trust ladder: observe, recommend, act in a sandbox, act with a PR](/blog/images/ledger-2026-02-trust-ladder.png)

Observing (read metadata, price every job, change nothing) is still most of what Latchkey does. Recommending, with a score that weights evidence over a model's opinion of itself, shipped in December and January. Acting with a PR has existed for workflow YAML since the autumn, and January rebuilt it around accepting or skipping each change. Acting in a sandbox, changing the environment of one running job, is where we are going and is not built.

We shipped a form of rung four before rung three on purpose. A PR is the safest way for automation to change anything, because nothing happens until a person says so. Acting inside a running job, before anyone has looked, is the step that has to be earned, on the record of everything below it.

The first issue set three rules for a CI that acts. We are adding two. These are the five we hold ourselves to:

1. **Repair the environment, never the code.** A missing tool, a full disk or a registry timeout may be fixed. Your source, tests and assertions may not be touched to produce a green check.
2. **A real failure stays red.** A failing test that catches a bug is doing its job. It can be diagnosed and explained. It is never masked, skipped or retried until it passes.
3. **Permanent changes arrive as PRs you review.** Branch, commit, pull request. Never a push to your default branch, never a merge on your behalf.
4. **Every automated action is explained and auditable.** Today that means you can see what prompted each analysis and how it ended, who applied which insights and which PR they became, and the PR itself says what changed and what we expect it to do.
5. **The human, or their agent, stays in control of the code.** Latchkey proposes. Whoever owns the repository decides, whether that is a person reading the diff or a coding agent they have delegated the review to. We don't get a vote on what merges.

## Coming next

February starts with a launch. We plan to put Latchkey on Product Hunt early this month. We are already in open beta, so it is a spotlight rather than a starting line, but it will be the first time many people see the product.

Just before it, teams arrive. You will be able to belong to several organizations and switch between them, invite people by email or link, and give each person a role: the **owner** who connected the GitHub organization, **admins** who manage monitoring, billing and invitations, and **members** who can read everything and apply insights as PRs but cannot change monitoring, billing or membership. Seats become part of every plan at the same time. Alongside teams comes rewritten documentation, with a walkthrough video for each dashboard page, so you can see what a page is for before you open it.

After the launch, the dashboard: whatever new traffic shows is broken or confusing gets fixed quickly.

The bigger change is where Latchkey sits in the pipeline. Everything in this update watches CI from outside and reports on it. The ladder above says where that has to go, and rung three is not something you can build from outside a job. We are working through what that means in the coming months. I'll say more when there is something concrete to describe, and not before.

Previous issue: [January Update: Backed by LAUNCH, and Rethinking CI for Agents](/blog/latchkey-is-backed-by-launch) · Next issue: [March Update: Latchkey Runners and Self-Healing Are Coming](/blog/coming-in-april-latchkey-runners-and-self-healing)

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt