CI Pipelines

Run Eridian Dev checks in GitHub Actions, GitLab CI, and Jenkins.

Use Eridian Dev as required checks: review, tests, and PR summary. The CI job holds an eridian_sk_ with dev:write scoped to the Dev project. It never uses a human SSO token.

GitHub Actions

yaml

name: eridian-dev
on:
  pull_request:
    types: [opened, synchronize, reopened]
jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Eridian review
        env:
          ERIDIAN_API_KEY: ${{ secrets.ERIDIAN_API_KEY }}
          ERIDIAN_PROJECT_ID: prj_dev_001
        run: |
          npx @eridian/cli dev review \
            --repository repo_payments_core \
            --pr "${{ github.event.pull_request.number }}" \
            --head "${{ github.event.pull_request.head.sha }}" \
            --publish

name: eridian-dev
on:
  pull_request:
    types: [opened, synchronize, reopened]
jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Eridian review
        env:
          ERIDIAN_API_KEY: ${{ secrets.ERIDIAN_API_KEY }}
          ERIDIAN_PROJECT_ID: prj_dev_001
        run: |
          npx @eridian/cli dev review \
            --repository repo_payments_core \
            --pr "${{ github.event.pull_request.number }}" \
            --head "${{ github.event.pull_request.head.sha }}" \
            --publish

Store ERIDIAN_API_KEY in the org or repo secrets. The key must be eridian_sk_ for prj_dev_001. Do not log it.

GitLab CI

yaml

eridian_review:
  stage: verify
  image: node:22
  script:
    - npx @eridian/cli dev review --repository repo_payments_core --mr "$CI_MERGE_REQUEST_IID" --publish
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

eridian_review:
  stage: verify
  image: node:22
  script:
    - npx @eridian/cli dev review --repository repo_payments_core --mr "$CI_MERGE_REQUEST_IID" --publish
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

Jenkins

Use the same CLI in a sh step. Inject ERIDIAN_API_KEY from the credentials store. Set ERIDIAN_BASE_URL=https://api.geteridian.com/v1.

Required checks

Map Git host required status names to Eridian jobs:

Check	Command	Fail when
`eridian/review`	`dev review`	Any finding at or above `severity_floor`
`eridian/tests`	`dev tests --apply && your test runner`	Suite red, or generation error
`eridian/summary`	`dev pr summarize --apply`	API error, not on prose quality

Do not block merge on low style comments.

Idempotency

Use the head SHA as the idempotency key:

text

Idempotency-Key: review-${{ github.event.pull_request.number }}-${{ github.sha }}

Idempotency-Key: review-${{ github.event.pull_request.number }}-${{ github.sha }}

Re-running the workflow on the same SHA returns the original review. A new SHA is a new job. See Idempotency.

Branch protection

The Git app posts a check run. If you do not use the app, post the check yourself from CI using the host API. Eridian does not impersonate github-actions[bot] unless you install the app.

Fail closed on gateway errors

If POST /v1/dev/reviews returns 503 model_unavailable, fail the check. Do not skip. Pin fallback in the project routing policy so GPT can hop to Gemini (or the reverse) before the gateway 503s. See Routing and Runbooks.

Cost

CI reviews are billable inference. Tag them:

json

{
  "metadata": {
    "workflow": "ci_review",
    "desk": "payments",
    "ci_run": "github-actions"
  }
}

{
  "metadata": {
    "workflow": "ci_review",
    "desk": "payments",
    "ci_run": "github-actions"
  }
}

See Usage and Budgets. A retry storm without idempotency will burn the desk budget.

See Dev API for the raw HTTP the CLI wraps.

Production API credentials are issued with an institution workspace. Contact sales if you need access.