Quickstart

Every command on this page is ciresk ci <command>. This page assumes the CLI is installed and logged in; if not, start with Install the CLI.

What you need

Check the set-up before the first run:

ciresk ci doctor

Every line is ok or fix with the command that repairs it, and the last line is the next command to run.

Create the manifest

ciresk ci init

init writes .ciresk/ci.yaml with check and test for the toolchain it detects, and lint where it finds a linter (clippy for Rust; a lint script or an eslint config for JavaScript). For Rust it also writes .config/nextest.toml, which makes nextest write the JUnit file the test task reports. A package.json gets the package manager its packageManager field names, else the one whose lockfile is there, else npm. Edit the files and commit them; the full reference is Manifest. For a single Rust crate init writes this (without the comments it adds):

version: 1

toolchains:
  "cargo:cargo-nextest": "0.9.148"
  rust: "1.95.0"

globals:
  inputs: [".config/nextest.toml", ".ciresk/*.sh"]
  env: { CI: "true" }
  pass_env: []

workspace:
  warm: true
  keep: ["target"]

tasks:
  check:
    run: "cargo check --all-targets"
    inputs: ["src/**", "Cargo.toml"]
    affected: { strategy: cargo, targets_arg: "-p {crate}" }
    timeout: "10m"
  test:
    run: "cargo nextest run"
    inputs: ["src/**", "Cargo.toml"]
    affected: { strategy: cargo, targets_arg: "-p {crate}" }
    timeout: "10m"
    report: { junit: "target/nextest/default/junit.xml" }
  lint:
    run: "cargo clippy --all-targets -- -D warnings"
    inputs: ["src/**", "Cargo.toml"]
    affected: { strategy: cargo, targets_arg: "-p {crate}" }
    timeout: "10m"

ciresk ci lint runs the lint task. Every tool a run line calls comes from toolchains: cargo nextest works because of the cargo:cargo-nextest entry. For Node, the TypeScript example is the pnpm version to start from.

Run a check

ciresk ci check --follow

check runs the check task on your working tree (on the targets you pass with -p, else the whole run command), waits and prints the summary. --follow streams the task's log to stderr while it runs.

tree: 612 entries, 1,070,702 bytes, root 1d6ccb175d0e; walk 9 ms, hashed 0 (reused 612) 1 ms, plan 0 ms: 0 blobs, 0 bytes: 0 inline bodies, 0 presigned puts, 0 multipart parts
timings: locate 4 ms, index 1 ms, walk 9 ms, hash 1 ms, plan 0 ms, upload 0 ms, submit 41 ms
budget: session 1296/72000 units, day 1296/720000, resets 00:00Z
job_01a158eea7347770a076e6b4ab7955d9: queued
job_01a158eea7347770a076e6b4ab7955d9: leased
job_01a158eea7347770a076e6b4ab7955d9: running
[ciresk] toolchains installed with mise in 45.9s
[ciresk] running `cargo check --all-targets` in .
[ciresk] exit Some(0)
job_01a158eea7347770a076e6b4ab7955d9: succeeded
succeeded job_01a158eea7347770a076e6b4ab7955d9 check@main  8m 19s  14080 units  cache 0 hit / 1 miss / 0 write
trust: trusted_interactive (warm workspace, read-write cache)
next: ciresk ci status job_01a158eea7347770a076e6b4ab7955d9

With ciresk ci watch running, the tree: line reads tree: watcher live, nothing to upload. Progress, the timings and the budget line go to stderr; the data goes to stdout. With --json, stdout is exactly one JSON document.

Read the result

The exit code is the verdict: 0 is a pass, 1 is a failed task or test, and 2 to 8 name a reason that is not a code failure (usage, auth, policy, budget, cancelled, timed out, infrastructure). The full table is in Exit codes. A failed task ends with the failing tests, the last lines of the first failed task and the next command:

failed job_01a158e79d4874dcb4d5ca3a263a7f9f test@main  1m 12s  960 units  cache 1 hit / 1 miss / 0 write
trust: trusted_interactive (warm workspace, read-write cache)
tasks:
  test: failed, exit 1, 1m 8s
failing tests: 1
  FAIL manifest::parses_nested_manifests
       assertion `left == right` failed
tail of test (last 3 lines):
  test manifest::parses_nested_manifests ... FAILED
  error: test run failed
  [ciresk] exit Some(1)
next: ciresk ci tests job_01a158e79d4874dcb4d5ca3a263a7f9f

Human output ends with the exact command for the obvious drill-down, and every --json envelope carries it as next:

Run next rather than ask for a whole log: logs returns failed-only, the last 200 lines, at most 256 KiB per call, and says in band when it truncated.

After the first run

Limits and spend

Every job is metered in units, and every response carries the budget line you saw above: the units spent in this session and today against the caps, and the time the day resets (00:00 UTC). A new organization starts with these caps:

A job that would pass a hard cap is refused with exit code 5 and the time the window resets. ciresk ci budget prints where you stand, ciresk ci policy get every limit with its source, and an organization admin changes one with ciresk ci policy set hard_units_per_day=50000. Usage per month, and a monthly budget once a unit price is set for your organization, are on platform.ciresk.com under Billing.

Good to know

• A folder that was never git init-ed works the same: the first run registers it under a slug of its own and uploads the tree once; from the second run only changed files travel. See Caching and tree sync.
• Identical requests from two people or two agents are one job, and a retry after a timeout returns the same job. See How it works.
• A job started inside Claude Code or Codex is attributed to agent:claude-code or agent:codex. The actor is attribution only: the trust tier comes from your credential, the ref and your policy, and a policy with agent_branches_untrusted=true runs agent:* jobs as untrusted. CIRESK_ACTOR or --actor overrides the detected actor.