Customer story
Acme Platform — How a regulated monorepo team consolidated overnight fix automation onto one audit-linked desk.
deployment 2026-07-21 · 1.4M LOC monorepo
logo placeholder · no customer asset shipped yet
The team
Who Acme Platform is, and what they own.
Acme Platform is the regulated payments subsidiary of a mid-sized neobank; the platform team owns a single Rust-and-TypeScript monorepo that runs settlement, ledger reconciliation, and partner APIs out of one CI identity. Their regulator (the same body that audits the parent bank) wants every change to a settlement path to carry a per-PR audit row a compliance officer can replay, a signature over the commit, and an SBOM a downstream tool can ingest without translation. Before Driftlock, those three artefacts arrived by hand on every change — or, more often, did not arrive at all.
Team shape
Eleven engineers across two time zones; two staff engineers on rotation, the rest split across settlement, ledger, and partner API surfaces. No night-shift on-call — overnight triage went to whichever staff engineer had the calmest week.
Monorepo shape
One cargo workspace and one pnpm workspace under a single GitHub organisation; one protected main branch; one CI identity (a GitHub App); one Bazel cache. The team merges roughly 80 PRs a week, of which around a third touch a dependency boundary.
Compliance shape
SOC 2 Type II in flight, with a parent-bank auditor who asks for the seven per-PR fields (alert id, sandbox run hash, SBOM hash, approver chain, signature, diff bytes, triage verdict) on every settlement-touching PR. Quarterly evidence pack due each March and September.
Before Driftlock
What the week looked like before the watcher ran.
Before Driftlock, an overnight Dependabot advisory meant one of two staff engineers opened a laptop, read the advisory, hand-wrote a remediation PR, waited for CI, and reviewed their own diff at 03:00. If the advisory hit a settlement path, the same engineer also had to record the seven audit-trail fields by hand in the compliance spreadsheet — and the spreadsheet was already three advisories behind. Late-night triage was the rule, not the exception, and the audit-trail gap grew by roughly one PR per week.
Monorepo upgrades were a second, quieter tax. When Bazel, Rust, or the TypeScript toolchain moved forward, the platform team ran a manual upgrade sprint every six weeks: rebase the long-running branches, re-pin the toolchain in the lockfiles, re-run the heavy integration suites, and re-emit SBOMs by hand. Each sprint took roughly a week of one engineer's time and landed zero product PRs; the audit-trail entries from the upgrade PRs were stitched into the spreadsheet after the fact, with the seven fields patched up from memory.
Implementation
How the wiring landed in a week.
Driftlock shipped into the Acme Platform monorepo as a single Helm + Terraform deployment in the team's existing EKS cluster, sitting behind the same egress policy as the settlement services. The platform team pointed the watcher at four signal surfaces, onboarded the signing key into their existing KMS, and let the sandbox mount the monorepo's Bazel cache so reruns reused the team's own test evidence. The rollout week ended with the platform team, the compliance lead, and the parent-bank auditor walking through one PR together — the auditor replayed the run from the run id, verified the cosign signature, and diffed the SBOM hash against the dependency lockfile.
- GitHub App installInstalled as the same GitHub App identity that opens PRs today; no new identity introduced, no shared credentials moved.
- CI identityBound to the team's existing CI identity via OIDC; the sandbox reuses the same token so a reviewer sees a single signing line on every commit.
- On-call pager ingestionThe watcher reads the team's PagerDuty webhook and turns each overnight incident into a Triage-verdict PR; severity-3 incidents auto-merge on a second reviewer sign-off, severity-1 and -2 stay reviewer-gated.
- Monorepo upgrade pinA pinned subscription on Bazel, Rust, and TypeScript advisories; the watcher opens a single upgrade PR per release line and pins the lockfile in the same commit.
- Signing-key onboardingThe customer KMS-resident cosign key onboarded on day one; rotation runs on the parent-bank's quarterly cadence, with the Rekor claim payload keeping older signatures verifiable across rotations.
What changed
Three numbers the regulator and the platform team now share.
Each number has a stated unit — the same tone discipline the comparison and governance pages use, so a reader cross-checking the stats against the rest of the site reads the same shape.
Mean time to merge dependency advisories
3.4 hours
From a Dependabot advisory opening to a merged, signed PR — down from roughly 18 hours when one of two staff engineers picked it up overnight.
Weekly PRs shipped without human triage
24 PRs / week
Bazel, Rust, and TypeScript upgrade PRs the watcher opens and the platform team approves in batch; previously these cost a week of one engineer per quarter.
Audit questions answered in a single click
96 %
Of the auditor's quarterly evidence-pack questions answered by replaying the run id against the team's own storage tier — no Driftlock-managed control plane in the loop.
In the engineer's words
“The first quarter we ran Driftlock, the auditor opened the run id, replayed the sandbox, diffed the SBOM, and asked one follow-up — about a test fixture, not the audit trail. That is the moment we realised we had moved the bottleneck.”
Staff Platform Engineer · Acme Platform
fictional placeholder attribution · swap with the named customer before launch
See it on your stack
Run the same trial against one of your real monorepos.
Driftlock ships into your VPC, points at two of your existing watchlist surfaces for ten days, and signs every audit-linked PR with your cosign key in your KMS. The trial ends with a walkthrough of the same per-PR record the regulator replays here.