Install the CLI

Install

The installers verify every download against the release's signed checksums and refuse to install without minisign, so install it first: brew install minisign (macOS), apt install minisign or dnf install minisign (Linux, WSL2), scoop install minisign (Windows).

curl -fsSL https://get.ciresk.com/ci | sh
ciresk ci version

The installer puts ciresk and its CI plugin into ~/.ciresk/bin (%USERPROFILE%\.ciresk\bin on Windows) without root, and checks every download against the release's sha256 checksums and their minisign signature. It puts the directory on PATH for new terminals: on Windows in your user PATH, on macOS and Linux with one marked line in your shell's rc file (CIRESK_NO_MODIFY_PATH=1 prints the line instead). Running it again replaces a binary only when the release differs. CIRESK_VERSION=v1.0.3 pins the CI plugin's release, CIRESK_INSTALL_DIR picks another directory. version prints the CLI version, and the server's when a token is at hand.

Every Ciresk CI command is ciresk ci <command>. ciresk update updates ciresk and its plugins; ciresk ci update updates the CI plugin only. The source repository is not public yet, so the installer is the way to get the CLI; a ciresk-ci binary built from source is found on PATH, next to ciresk or in ~/.cargo/bin.

The CLI only connects where you allow it, in ~/.ciresk/egress.yaml (%USERPROFILE%\.ciresk\egress.yaml on Windows). The installer adds the rows each program it installs needs, once per program under a marked comment: get.ciresk.com for updates, the EU cell and its object store for ciresk ci. A row you delete stays deleted; delete the get.ciresk.com row to turn updates off. CIRESK_EGRESS_FILE points ciresk at another file. If you installed ciresk another way, ciresk ci doctor says which rows are missing and ciresk ci update writes them. The update row:

- host: get.ciresk.com
  purpose: ciresk update
  products: [updater]

Log in

ciresk ci auth login

A code and a URL appear and the browser opens for the device flow (--no-browser prints them only). You need an organization with Ciresk CI turned on; see Quickstart. The token goes to the OS keychain, never to a file in the repository, and the keychain is read before any environment variable. ciresk ci auth status shows who you are; ciresk ci auth logout removes the token. ciresk ci auth login --token csk_live_eu_... stores an API key in the keychain instead.

export CIRESK_TOKEN=csk_live_eu_...
ciresk ci --pass-token check

CIRESK_TOKEN (or CIRESK_CI_TOKEN) is the fallback for CI and containers: a csk_live_eu_... token from platform.ciresk.com under API tokens. In GitHub Actions the Ciresk CI action exchanges the job's OIDC token for a one-hour token instead. The CLI never prints it. ciresk ci drops CIRESK_TOKEN and CIRESK_CI_TOKEN from the environment unless you add --pass-token; without it the CLI reads the OS keychain. Keys carry the organization and its region, so nothing else needs to be configured; --api-url or CIRESK_CI_API_URL points the CLI at another origin.

Check the setup

ciresk ci doctor

doctor checks the egress file, the token, the API, your organization's workers, the tree, the manifest, the repository and the index in one go, one line each, with the fix when one fails. It also prints the tree's size, the ten largest files and whether ciresk ci watch is running.

Good to know

• Every command takes --json, --api-url, --timeout and --quiet; the full list is in CLI commands.
• The worker is a separate binary, ciresk-ci-worker; see Run your own worker.