Instrumenting CI/CD Pipelines via Syscall Interception

A CI agent uses Linux syscall interception (ptrace + seccomp-bpf filters) to instrument CI/CD pipelines without modifying them. By intercepting only execve syscalls, it achieves near-zero overhead (<0.1%) while capturing complete visibility into process execution, timing, tool versions, and environment configuration. The agent can attach to running processes, making it compatible with managed runners like GitHub Actions. Use cases include automatic OpenTelemetry tracing, test coverage collection, security scanner enforcement, dependency graph extraction, and custom metadata collection. The approach enables centralized observability and policy enforcement across all pipelines without per-repository configuration changes.