KvantumCI Release

Convergence

Out now v1.4.0 Released July 2026

New rule sets for GitHub Actions and Argo CD. A build determinism check that catches non-reproducible installs—plus bulk repository import and analytics for every repository.

See what shipped

Introducing Update 1.4

Reproducibility is a security property, not just a build setting. Convergence expands verification with dedicated rule sets for GitHub Actions and Argo CD, brings your whole estate in with bulk import, and adds analytics for every repository—then closes the loop with a new rule that catches non-deterministic build commands before they reach production.

What’s in the release

Five upgrades, one Convergence

Everything that ships in v1.4.0—follow the rail through each chapter below.

01 Bulk Import Import your whole estate in one pass. 02 GitHub Actions Workflow verification and security rule set. 03 Argo CD GitOps verification and best practices. 04 Analytics & Progress Repo-scoped analytics, scan progress. Finale Build Determinism Catch non-reproducible builds at the source.

01Onboarding

Bulk Import

Stop adding repositories one at a time. Bring in your whole estate from a JSON or CSV file, or connect a named integration, then narrow the list down to exactly what you want before you commit.

  • Import from a JSON or CSV file, or a named integration
  • Guided wizard for selecting and importing many repositories at once
  • Filter candidates by name, branch, language, last activity, or owner before importing
Repository bulk import wizard with source and filtering options
GitHub Actions workflow verification and security rule set

02CI verification

GitHub Actions verification & security

GitHub Actions is where most teams run CI—and where misconfigurations hide. Convergence adds a dedicated rule set for workflow verification scanning and security checks across your pipelines.

  • New rule set for GitHub Actions workflows
  • Verification scanning of workflow security practices
  • Surfaces permissions, secrets usage, and unsafe patterns before production

03GitOps

Argo CD rule set

GitOps delivery needs the same continuous verification as application code. Convergence adds a dedicated rule set for Argo CD that validates GitOps best practices and security posture across your deployment pipelines.

  • New rule set for Argo CD deployments and GitOps configs
  • Validates GitOps best practices in delivery pipelines
  • Strengthens security posture across Kubernetes GitOps estates
Argo CD rule set verification and GitOps best-practice checks
Repository-scoped analytics and scan progression indicator

04Visibility

Analytics & Progress

See what's happening, repo by repo, run by run. Repository-scoped analytics break results down per repository, and a new scan progression indicator shows exactly where a verification run stands.

  • Repository-scoped analytics
  • Scan progression indicator for verification runs
  • Broader UI overhaul and UX refinements to make day-to-day verification work easier

FinaleReproducibility

Build Determinism

A build that resolves different dependency versions on every run can't be trusted or reproduced. Convergence adds a new rule engine check that flags non-deterministic install commands and confirms a deterministic, lockfile-respecting command is used instead—alongside new rule sets for GitHub Actions and Argo CD, so CI and GitOps pipelines are verified end to end.

  • Flags non-deterministic build commands across CI configs
  • Confirms a deterministic alternative is used instead
  • Reduces exposure to silent dependency drift between builds
  • Strengthens the guarantee that what was scanned is what shipped
✕ Flagged npm install

Dependency versions can drift between runs.

✓ Verified npm ci

Installs exactly what's pinned in the lockfile.

Convergence is live in v1.4.0. Verify GitHub Actions, Argo CD, and reproducible builds on your next run.

Explore Convergence

New rule sets for GitHub Actions and Argo CD, build determinism checks, and bulk import—on your next run. No credit card required.

Patch notes · v1.4.0

Convergence — full patch notes

Everything that shipped in the Convergence release.

New features

  • Bulk import: Import from a JSON or CSV file, or a named integration, with a guided wizard.
  • Import filtering: Filter candidates by name, branch, language, last activity, or owner before importing.
  • Analytics & progress: Repository-scoped analytics, a scan progression indicator, and a broader UI overhaul for easier day-to-day use.

Rule engine

  • GitHub Actions rule set: Verification scanning and security checks for GitHub Actions workflows.
  • Argo CD rule set: GitOps verification and best-practice checks for Argo CD.
  • Build determinism: New rule flags non-deterministic install commands (e.g. npm install) and confirms a deterministic alternative (e.g. npm ci) is used instead.
  • Drift detection: Reduces exposure to silent dependency drift between builds of the same pipeline.
  • Stronger provenance: Strengthens the guarantee that what was scanned is what actually shipped.

Fixes

  • MLflow rule: Fixed a false positive.
See the v1.4.0 entry in the changelog →