Continuous Integration

Wiring taskless check into CI runs your rules automatically on every push and pull request. Add a check step to your existing pipeline. The patterns here translate to any CI system.

Two Scan Patterns

• Full scan: npx @taskless/cli check. Scans everything. Best for runs on your main branch.

• Diff scan: check only the files that changed. Faster for pull-request builds:

  npx @taskless/cli check $(git diff --name-only "origin/$TARGET_BRANCH...HEAD")

check silently filters paths that don’t exist, so raw git diff --name-only output can pipe in directly. A good default is a diff scan on pull requests and a full scan on pushes to main.

GitHub Actions Reference

name: Taskless

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Taskless check
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            git fetch origin "${{ github.base_ref }}" --depth=1
            FILES=$(git diff --name-only "origin/${{ github.base_ref }}...HEAD")
            [ -z "$FILES" ] && echo "No changed files." && exit 0
            npx @taskless/cli check $FILES
          else
            npx @taskless/cli check
          fi

The same shape (checkout with full history, set up Node, run a conditional check) translates to GitLab CI, CircleCI, Jenkins, Azure Pipelines, Bitbucket, and others. Substitute npx with pnpm dlx, yarn dlx, or bunx to match your project’s package manager. For the full per-CI recipe, run npx @taskless/cli agent ci.

Enforcing Runtime Rules (Optional)

taskless check needs no authentication by default. Your sg and vale rules always run in CI with no secrets. Runtime rules, which execute a check.ts, are skipped in an unauthenticated job. They are reported rather than failed, so an unauthenticated pipeline stays green on them.

To turn CI into the enforcement point for runtime rules, expose a TASKLESS_TOKEN secret. An authenticated check reconciles each runtime rule against the Taskless service and runs exactly the server-blessed set:

- name: Taskless check
  env:
    TASKLESS_TOKEN: ${{ secrets.TASKLESS_TOKEN }}
  run: |
    # ...same check step as above

This is what makes CI the backstop: local developer runs skip runtime rules unless they pass --dangerously-run-scripts, but an authenticated CI job runs the verified set on every change. See Security for the full model.