GitHub Actions

The action

The Ciresk CI action runs one action (check, test, build, lint or a task from .ciresk/ci.yaml) on remote workers and makes the job's result a GitHub result: the step fails with the CLI's own exit code, failing tests become file and line annotations, and the summary lands in the job summary. None of it calls GitHub's API: annotations are workflow commands on the step's output and the summary and outputs are files the runner reads, so the action needs no checks: write or other GitHub permission beyond id-token: write. The job's OIDC token is exchanged for a one-hour cell token; your organization's trust rule decides which repository and ref may run what and with which trust tier.

Two things are not self-service today. The action is not published yet: its files are in tools/ci/integrations/github-action/ of the Ciresk source repository, which is not public, so outside Ciresk a workflow can neither reference nor copy it. And an OIDC trust rule, which maps your repository and ref to a principal, has no API, CLI or console page yet, so you cannot create one; without one the exchange fails with oidc_rejected, reason: unknown_repo. Until then GitHub Actions authenticates with a stored key: install the CLI with the installer (minisign first), put ~/.ciresk/bin on $GITHUB_PATH, keep a csk_live_eu_... API key in a repository secret, and run ciresk ci --pass-token run check --wait --format github with CIRESK_TOKEN set from it, the path Install the CLI documents for machines. --format github gives that step the same annotations, job summary and outputs as the action (below). That key is long-lived, unlike the one-hour exchange.

Inside Ciresk, copy the action into the repository as .github/actions/ciresk-ci/, with these files from tools/ci/integrations/github-action/:

Keep the scripts executable (chmod +x .github/actions/ciresk-ci/scripts/*.sh) and reference the action by its local path:

jobs:
  ciresk:
    runs-on: ubuntu-latest
    permissions:
      id-token: write    # the OIDC token the action exchanges
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0   # the CLI walks ancestors to find a commit the mirror has
      - uses: ./.github/actions/ciresk-ci   # a local action is read from the checkout above
        with:
          action: test

Inputs

Outputs

What the steps do

The exchanged token never enters GITHUB_ENV, GITHUB_OUTPUT or the log, and it expires with the hour. The CLI attributes the job to ci:github-actions:<actor> with the run id and attempt as session. The exchange asks for ci:jobs.run ci:jobs.read ci:repos.read ci:blobs.read ci:blobs.write; override with CIRESK_REQUESTED_SCOPES in the job's env. The repository must be registered before the first CI run, since ci:repos.write is left out.

What a failed run shows

--format github is a CLI flag, so the action and a step that runs the CLI itself report the same way. It applies to the commands that print a job summary: run --wait, check, test, build, lint, wait and summary.

A step that runs the CLI directly:

      - id: ciresk
        run: ciresk ci --pass-token test --format github
        env:
          CIRESK_TOKEN: ${{ secrets.CIRESK_TOKEN }}
      - if: always()
        run: echo "job ${{ steps.ciresk.outputs.job-id }} ${{ steps.ciresk.outputs.verdict }}"

Check runs per task, which a branch protection rule could require by name, are not built: they need Ciresk CI to call GitHub's API. Until they are, the step's result is the status a pull request shows.

Hooks that gate a push

For people and agents that do not run through the Claude Code hook, a git pre-push hook runs ciresk ci run check --wait and refuses the push with the CLI's exit code when the job did not succeed. The CLI prints the summary itself. The script is the one file tools/ci/integrations/pre-commit/pre-push in the Ciresk source, printed here in full because that repository is not public yet. Save it as .git/hooks/pre-push and make it executable (chmod +x .git/hooks/pre-push):

#!/usr/bin/env sh
# runs the repository's check on Ciresk CI before anything leaves the machine and refuses the push
# with the cli's exit code when the job did not succeed. skip once: CIRESK_CI_SKIP=1 git push
set -u

if [ "${CIRESK_CI_SKIP:-0}" = "1" ]; then
  exit 0
fi

# git feeds "<local ref> <local sha> <remote ref> <remote sha>" per ref on stdin; a push that only
# deletes refs has nothing to check. with no stdin (the pre-commit framework) the check always runs
seen=0
pushing=0
while read -r _local_ref local_sha _remote_ref _remote_sha; do
  seen=1
  case "$local_sha" in
    0000000000000000000000000000000000000000) ;;
    *) pushing=1 ;;
  esac
done
if [ "$seen" = 1 ] && [ "$pushing" = 0 ]; then
  exit 0
fi

bin="${CIRESK_CI_BIN:-ciresk-ci}"
if ! command -v "$bin" > /dev/null 2>&1; then
  echo "pre-push: ${bin} is not on PATH; install the ciresk cli, or push once with CIRESK_CI_SKIP=1" >&2
  exit 1
fi

"$bin" run check --wait
code=$?
if [ "$code" -ne 0 ]; then
  echo "pre-push: ciresk ci check exited ${code}; fix it, or push once with CIRESK_CI_SKIP=1" >&2
fi
exit "$code"

Exit codes 3 (auth), 4 (policy) and 5 (budget) block the push like 1 does: they mean the check did not run, and the message names the fix. The hook is POSIX sh and needs nothing but the CLI. The pre-commit framework takes the same script as a repo: local entry with pre-commit install --hook-type pre-push.