CI/CD Integration
Add DeepSweep to your CI/CD pipeline
GitHub Actions
Add the official GitHub Action to your workflow. The pull-requests: write permission is what lets the Action post the result on the pull request, where the rest of the team sees it:
# .github/workflows/deepsweep.yml
name: DeepSweep
on: [push, pull_request]
permissions:
contents: read
pull-requests: write
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Agent Environment Review
uses: deepsweep-ai/action@v1
with:
path: .Using the Result Downstream
The Action publishes the posture score (0-100), its band, the identity attestation the score was computed under and the finding count as step outputs, plus a ready-made README badge. Gate the merge with fail-below-score, or read the outputs yourself and decide. Note that score is empty when the repository has no agent configuration to score, which is not the same as scoring badly — fail-below-score fails the job in that case rather than passing a gate it cannot evaluate:
- name: Agent Environment Review
id: review
uses: deepsweep-ai/action@v1
with:
path: .
# Bands: weak <40, fair <70, good <90, strong above.
# 40 blocks only genuinely weak posture; raise it as you harden.
fail-below-score: 40
- name: Report the posture
run: |
echo "Posture: ${{ steps.review.outputs.score }}/100 (${{ steps.review.outputs.posture-band }})"
echo "Identity attestation: ${{ steps.review.outputs.attestation }}"
echo "Findings: ${{ steps.review.outputs.findings }}"Other CI Systems
The reviewing engine ships inside the GitHub Action and sets itself up on the runner — there is nothing to install and nothing on the PATH. On other CI systems, run the review locally in the Studio or the editor extension and export the report; a hosted runner for other providers is not available yet, and we would rather say so than point you at a channel we do not control.
Before You Commit
The editor extension reviews agent configuration files as you edit them, so a poisoned rules file or a risky MCP entry is flagged before it is ever committed — which is earlier, and cheaper, than any pipeline gate.