CI/CD integration

Ready-made pipeline snippets for GitLab CI, Bitbucket Pipelines, Azure Pipelines, GitHub Actions, and plain shell.

The pattern is the same everywhere:

Store your API key as a masked CI secret named PATCHLIGHT_API_KEY.
Check out with enough git history for git merge-base (see each tab).
Run npx @patchlight/sdk review --wait — add --fail-on high to block merges on severe findings.

code-review:
  image: node:20
  stage: test
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    GIT_DEPTH: "0"          # full history so merge-base works
  script:
    - npx @patchlight/sdk review --wait --fail-on high

The CLI picks the base branch up from CI_MERGE_REQUEST_TARGET_BRANCH_NAME automatically. Add PATCHLIGHT_API_KEY under Settings → CI/CD → Variables (masked).

pipelines:
  pull-requests:
    '**':
      - step:
          name: Code review
          image: node:20
          clone:
            depth: full
          script:
            - npx @patchlight/sdk review --wait --fail-on high

The base branch comes from BITBUCKET_PR_DESTINATION_BRANCH. Add PATCHLIGHT_API_KEY under Repository settings → Repository variables (secured).

trigger: none
pr:
  branches:
    include: ["*"]

pool:
  vmImage: ubuntu-latest

steps:
  - checkout: self
    fetchDepth: 0
  - task: NodeTool@0
    inputs:
      versionSpec: "20.x"
  - script: npx @patchlight/sdk review --wait --fail-on high
    env:
      PATCHLIGHT_API_KEY: $(PATCHLIGHT_API_KEY)

The base branch comes from SYSTEM_PULLREQUEST_TARGETBRANCHNAME. Define PATCHLIGHT_API_KEY as a secret pipeline variable.

Repos on GitHub are usually better served by the GitHub App (automatic PR reviews with inline comments), but the CLI works there too — useful for GitHub Enterprise Server without the App:

name: Code review
on: pull_request

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npx @patchlight/sdk review --wait --fail-on high
        env:
          PATCHLIGHT_API_KEY: ${{ secrets.PATCHLIGHT_API_KEY }}

Any environment with git + Node 18.17+:

export PATCHLIGHT_API_KEY=pl_sk_...

# Diff against a specific base branch:
npx @patchlight/sdk review --base origin/main --wait --fail-on high

# Or pipe a pre-computed diff (e.g. from another VCS) via stdin:
git diff origin/main...HEAD | npx @patchlight/sdk review --diff - --repo acme/app --wait

Tips

--fail-on high blocks the pipeline on high and critical findings; use --fail-on critical for a looser gate, or drop the flag to make the step purely informational.
Retried CI jobs don't create duplicate reviews — submission is idempotent per repo + commit.
Use --json to feed findings into your own tooling (e.g. posting a comment on a GitLab MR via its API).
Findings and summaries also appear in the dashboard under the repository name the CLI detected (override with --repo).

Tips

On this page