Review in CI
Review every merge request from GitLab, Bitbucket, Azure Pipelines, GitHub Actions or any shell, and gate merges on the findings.
On GitHub, the GitHub App reviews pull requests with no pipeline at all. Use this page for everything else, or when you want a review to block a merge.
Setup
- Create an API key on the API Keys page of the dashboard. It is shown once.
- Store it as a masked CI secret named
PATCHLIGHT_API_KEY. - Clone with full git history, so the base branch can be found (each example below does this).
- Run the review:
npx @patchlight/sdk review --wait --fail-on highThe command finds the base branch from your CI provider's environment, diffs against it, uploads the changed files as context, waits for the review and prints the findings.
Pipeline examples
code-review:
image: node:20
stage: test
rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
variables:
GIT_DEPTH: "0" # full history so merge-base works
script:
- npx @patchlight/sdk review --wait --fail-on highThe base branch comes from CI_MERGE_REQUEST_TARGET_BRANCH_NAME. Add the key under
Settings → CI/CD → Variables, masked.
pipelines:
pull-requests:
'**':
- step:
name: Code review
image: node:20
clone:
depth: full
script:
- npx @patchlight/sdk review --wait --fail-on highThe base branch comes from BITBUCKET_PR_DESTINATION_BRANCH. Add the key under
Repository settings → Repository variables, secured.
trigger: none
pr:
branches:
include: ["*"]
pool:
vmImage: ubuntu-latest
steps:
- checkout: self
fetchDepth: 0
- task: NodeTool@0
inputs:
versionSpec: "20.x"
- script: npx @patchlight/sdk review --wait --fail-on high
env:
PATCHLIGHT_API_KEY: $(PATCHLIGHT_API_KEY)The base branch comes from SYSTEM_PULLREQUEST_TARGETBRANCHNAME. Define the key as a secret
pipeline variable.
name: Code review
on: pull_request
jobs:
review:
# Fork pull requests get no secrets, so skip them instead of failing.
if: github.event.pull_request.head.repo.full_name == github.repository
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: actions/setup-node@v4
with:
node-version: 20
- run: npx @patchlight/sdk review --wait --fail-on high
env:
PATCHLIGHT_API_KEY: ${{ secrets.PATCHLIGHT_API_KEY }}Useful on GitHub Enterprise Server, or anywhere the GitHub App is not installed.
export PATCHLIGHT_API_KEY=pl_sk_...
# Diff against a base branch you name
npx @patchlight/sdk review --base origin/main --wait --fail-on high
# Or pipe in a diff you already have, from any VCS
git diff origin/main...HEAD | npx @patchlight/sdk review --diff - --repo acme/app --waitWorks anywhere with git and Node.js 18.17 or newer.
Gate merges
--fail-on sets the severity that fails the job.
| Flag | The job fails on |
|---|---|
--fail-on high | high and critical findings |
--fail-on critical | critical findings only |
| no flag | nothing, the step is informational |
Exit code 4 means the platform was busy or briefly unavailable, and the job is safe to retry.
Every exit code is listed in the command reference.
Good to know
- Retries are safe. Submitting is idempotent per repository and commit, so a retried job returns the existing review instead of starting a new one.
- Shallow clones overstate the change. Without history, the diff falls back to the base ref directly. Fetch full history as the examples do.
- Machine-readable output. Add
--jsonto feed findings into your own tooling. - Dashboard name. Reviews are filed under the repository name read from the
originremote. Override it with--repo.