Docs / Use / CI

CI

Use --fail-on to turn findings into a failing exit code.

Exit codes

0: finished, nothing at or above the threshold.
1: tool error. Treat it as an infrastructure failure.
2: a finding met the threshold. This is the drift signal.

Pick the threshold by how strict you want to be: --fail-on critical fails on deprecated SDKs and legacy packages; --fail-on warning also fails on one-major-behind and on unknowns.

Live data in CI

Export your stored Raven login once, on a machine where you are signed in, and store it as a repository secret:

Terminal

kedgeway login --export | pbcopy   # macOS; use xclip or wl-copy elsewhere

Create a secret named KEDGEWAY_AUTH with that value (Settings, Secrets and variables, Actions). In the GitHub Action pass it as auth: ${{ secrets.KEDGEWAY_AUTH }}. Outside the action, set the KEDGEWAY_AUTH environment variable yourself.

Prefer no secret at all? Run offline against a saved snapshot with --fixture and refresh it by hand. See Fixtures. The action needs one of the two: auth or fixture.

GitHub Actions example

Install the published CLI and check the repo against a committed fixture. For the maintained action, see GitHub Action.

yaml

name: kedgeway
on: [push, pull_request]
jobs:
  diagnose:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm install -g kedgeway
      - run: kedgeway diagnose . --fail-on warning --fixture snapshot.json

The diagnose step exits 2 when a warning or critical finding exists, and 1 on a tool error. Commit snapshot.json next to the workflow, or drop --fixture and set KEDGEWAY_AUTH in the step environment for live data.