Quickstart

The fastest path to a verdict is the GitHub Action. It installs the CLI, runs the scope check, optionally triggers a test run, and reports back as the izri/quality check on your pull request.

Before you start

You need an Izri organization with your repository connected. If you haven't connected it yet, see Projects and repositories — the GitHub App installation is what lets Izri read your diffs and publish checks.

1. Mint an API token

From your organization settings, create an API token and copy it.

Every Izri token starts with izri_. The API short-circuits to bearer-token validation on that prefix alone, so a token missing it produces an opaque 401 rather than a useful error. If you get an unexplained 401, check the prefix first.

Add the token to your repository as a secret named IZRI_API_TOKEN:

Settings → Secrets and variables → Actions → New repository secret

2. Add the workflow

Create .github/workflows/izri.yml:

name: izri
on:
  pull_request:
    branches: [main]

jobs:
  izri:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: legendify-dev/izri/apps/github-action@v1
        with:
          api-token: ${{ secrets.IZRI_API_TOKEN }}

fetch-depth: 0 is not optional. The scope check compares your head against origin/<base>, and a shallow clone has no base ref to compare against. This is the single most common setup failure.

Everything else has a default. mode runs both the scope check and a test run, the project is auto-resolved from your git origin remote, and the workflow fails when a hard finding appears. See the GitHub Action reference for all eight inputs.

3. Open a pull request

Push a branch and open a PR against main. The Action runs, and two surfaces light up:

• the izri/quality check on the PR, with one child check per signal
• a sticky comment summarizing the verdict, edited in place on each new push

If the run seems stuck, the troubleshooting guide covers the usual causes.

4. Make the check binding

Until you require it, izri/quality is advisory — it reports but nothing enforces it.

Settings → Branches → Branch protection rules → Require status checks to pass, then add izri/quality.

Require the umbrella, not the four children. The umbrella already aggregates them, and requiring children individually means a skipped signal — visual on a backend-only diff, for example — blocks a merge that should sail through.

Next steps

• Your first verdict — reading the result.
• .izri/scope.yml — tell the scope check what your project considers sensitive.
• CLI — run the same checks from your terminal.