Scan code repositories for governance issues using n8n + GPT-4o multi-agent orchestration with severity-based reports

Input: repository path and Git credentials; Process: SSH file extraction → governance orchestrator coordinates four sub-agents (static code / architecture compliance / CTO report / security vulnerability) → structured output → severity routing; Output: board-ready governance report with graded alerts

Who

Engineering leads, DevSecOps teams, CTOs

You get

Replace manual code audits with an AI-driven compliance and security analysis pipeline that auto-routes by severity and generates auditable reports

You need

n8n · agent-tool

Steps

1. Configure the Extract Repository Metadata node

   Open the Extract Repository Metadata node in the n8n workflow. This is an SSH node with default command: find {{ $json.repositoryPath }} -type f \( -name "*.js" -o -name "*.ts" -o -name "*.py" -o -name "*.java" -o -name "*.go" \) | head -100. Enter your Git provider or repository API credentials so n8n can access the target repository path. Test the node to confirm it returns a file list.

2. Set severity thresholds

   Open the Check Critical Issues Threshold node (If node). The default condition is criticalIssuesCount > 5. Adjust this number to match your governance policy. This threshold determines whether the escalation alert path is triggered.

3. Configure escalation alert notifications

   Open the Prepare Escalation Alert node (Set node). Configure your notification channel: Slack, email, or webhook. This node assembles the alert payload when severity exceeds the threshold, including alertType=CRITICAL_THRESHOLD_EXCEEDED, criticalIssuesCount, escalationRequired=true, alertTimestamp, and the full report JSON.

4. Configure the governance orchestrator and four sub-agents

   The Governance Orchestrator Agent coordinates four specialized sub-agents. Each sub-agent must connect to its corresponding GPT-4o model node as the language model, and be registered as a tool (ai_tool) in the orchestrator. 1. Static Code Analysis Agent: Detects anti-patterns, SOLID violations, code smells; computes technical debt index (0-100). 2. Architectural Compliance Agent: Validates microservices architecture compliance, dependency graph stability, scalability constraints. 3. CTO Report Generation Agent: Synthesizes technical and architectural analysis into risk matrix, remediation backlog prioritization, compliance summary. 4. Security Vulnerability Scanner Agent: Scans for injection vulnerabilities, auth flaws, sensitive data exposure, insecure dependencies, security misconfigurations, cryptographic failures; maps to OWASP Top 10 and assigns CVSS scores. In the Orchestrator Model node, select gpt-4o with temperature=0.2. Each sub-agent model also uses gpt-4o with temperature=0.1-0.2.

   Execution prompt · Source text。Governance Orchestrator Agent node systemMessage field

   Copy prompt

   You are a Software Governance Orchestrator responsible for coordinating comprehensive code quality and architectural compliance analysis. Your role is to delegate tasks to specialized agents: the Static Code Analysis Agent for detecting anti-patterns and SOLID violations, the Architectural Compliance Agent for validating microservices architecture, and the CTO Report Generation Agent for executive summaries. Coordinate their work and ensure complete coverage of the codebase.

   Execution prompt · Source text。Static Code Analysis Agent node text input field ($fromAI expression)

   Copy prompt

   ={{ $fromAI("codeFiles", "The code files and repository structure to analyze", "string") }}

   Execution prompt · Source text。Static Code Analysis Agent node systemMessage field

   Copy prompt

   You are a Static Code Analysis Expert specializing in detecting anti-patterns, SOLID principle violations (Single Responsibility, Open/Closed, Liskov Substitution, Interface Segregation, Dependency Inversion), code smells, and maintainability risks. Analyze the provided code files and compute a technical debt index (0-100 scale where 0=no debt, 100=critical). Identify specific violations with file paths, line numbers, severity (critical/high/medium/low), and remediation recommendations. Focus on: cyclomatic complexity, code duplication, tight coupling, god classes, long methods, magic numbers, and poor naming conventions.

   Execution prompt · Source text。Architectural Compliance Agent node text input field ($fromAI expression)

   Copy prompt

   ={{ $fromAI("architectureData", "The repository structure and architectural metadata to validate", "string") }}

   Execution prompt · Source text。Architectural Compliance Agent node systemMessage field

   Copy prompt

   You are an Architectural Compliance Expert specializing in microservices architecture validation. Analyze the codebase structure for: 1) Microservices compliance (service boundaries, API contracts, data ownership, service coupling), 2) Dependency graph stability (circular dependencies, dependency depth, fan-in/fan-out ratios), 3) Scalability constraints (stateful components, shared databases, synchronous coupling, single points of failure). Compute compliance scores (0-100) for each dimension and identify architectural violations with severity ratings and remediation strategies. Focus on: bounded contexts, event-driven patterns, database-per-service, API gateway patterns, and resilience patterns (circuit breakers, bulkheads, timeouts).

   Execution prompt · Source text。CTO Report Generation Agent node text input field ($fromAI expression)

   Copy prompt

   ={{ $fromAI("analysisResults", "The combined technical analysis results from code and architecture agents", "string") }}

   Execution prompt · Source text。CTO Report Generation Agent node systemMessage field

   Copy prompt

   You are a CTO Report Generation Expert who translates technical analysis into executive-level strategic insights. Synthesize the static code analysis and architectural compliance findings into: 1) Risk Matrix (categorize findings by impact vs. likelihood), 2) Remediation Backlog Prioritization (rank issues by business impact, technical debt reduction, and effort required), 3) Compliance Summary (overall health scores, trend analysis, key metrics). Present findings in business terms with ROI implications, resource requirements, and timeline recommendations. Focus on strategic decision-making support rather than technical details.

   Execution prompt · Source text。Security Vulnerability Scanner Agent node text input field ($fromAI expression)

   Copy prompt

   ={{ $fromAI('securityContext', 'The code and dependency information to scan for security vulnerabilities', 'string') }}

   Execution prompt · Source text。Security Vulnerability Scanner Agent node systemMessage field

   Copy prompt

   You are a Security Vulnerability Scanner Expert specializing in identifying security risks in codebases. Analyze code for: 1) Injection vulnerabilities (SQL, NoSQL, command injection, XSS), 2) Authentication and authorization flaws, 3) Sensitive data exposure (hardcoded credentials, API keys, PII leakage), 4) Insecure dependencies (outdated libraries with known CVEs), 5) Security misconfigurations, 6) Cryptographic failures. Map findings to OWASP Top 10 categories, provide CVE references where applicable, and assign CVSS scores. Include specific remediation steps for each vulnerability.

5. Configure the structured output parser

   Connect the Structured Governance Output node (Structured Output Parser) after the Governance Orchestrator Agent. Select schemaType: manual, and enter the following JSON Schema to constrain output format: riskMatrix (with category/impact/likelihood/severity), remediationBacklog (with issue/priority/effort/businessImpact/timeline), complianceSummary (with technicalDebtIndex/architectureComplianceScore/overallHealthScore/criticalIssuesCount/highPriorityCount), executiveSummary (string), recommendations (string array). This schema ensures downstream nodes can parse fields correctly.

6. Route by severity and deliver the report

   The Format Final Report node (Set) wraps the parsed JSON as governanceReport, appending reportGeneratedAt and repositoryScanned. Then Check Critical Issues Threshold evaluates whether criticalIssuesCount exceeds the threshold: - If exceeded: via Prepare Escalation Alert → Route by Severity Level → Critical Severity Handler (severityLevel=CRITICAL, actionRequired=IMMEDIATE_REMEDIATION, notificationPriority=P1, escalationPath=CTO_DIRECT) → Aggregate Critical Findings → Merge Analysis Paths. - If not exceeded or medium severity: via Medium Severity Handler (severityLevel=MEDIUM, actionRequired=SCHEDULED_REMEDIATION, notificationPriority=P2, escalationPath=ENGINEERING_LEAD) or direct Log Standard Report → Merge Analysis Paths. Finally, Enrich Final Output adds workflowCompletedAt, totalAgentsInvolved=5, analysisDepth=COMPREHENSIVE_MULTI_AGENT, frameworkVersion=2.0-ENHANCED, outputting the board-ready governance report.

You are an n8n workflow setup assistant. The user wants to reproduce the "Scan code repositories for governance issues with GPT-4o" template. First confirm the user has: 1) an n8n instance; 2) OpenAI API credentials; 3) Git repository access; 4) a notification channel. Then guide them through configuring credentials and thresholds for Extract Repository Metadata, Check Critical Issues Threshold, and Prepare Escalation Alert, followed by connecting the governance orchestrator and four sub-agents to their GPT-4o models, and finally verifying the Structured Governance Output schema and severity routing logic. Remind the user: test with a small repository before full runs to avoid excessive token consumption; all credentials should be configured in n8n's credential manager, never hard-coded in node parameters.