---
title: Quickstart
description: Add the GitHub Action, mint a token, and get your first verdict on a pull request in about five minutes.
order: 20
---

# Quickstart

The fastest path to a verdict is the GitHub Action. It installs the CLI, runs the scope check, optionally triggers a test run, and reports back as the `izri/quality` check on your pull request.

## Before you start

You need an Izri organization with your repository connected. If you haven't connected it yet, see [Projects and repositories](/docs/configure/projects) — the GitHub App installation is what lets Izri read your diffs and publish checks.

## 1. Mint an API token

From your organization settings, create an API token and copy it.

Every Izri token starts with `izri_`. The API short-circuits to bearer-token validation on that prefix alone, so a token missing it produces an opaque `401` rather than a useful error. If you get an unexplained 401, check the prefix first.

Add the token to your repository as a secret named `IZRI_API_TOKEN`:

**Settings → Secrets and variables → Actions → New repository secret**

## 2. Add the workflow

Create `.github/workflows/izri.yml`:

```yaml
name: izri
on:
  pull_request:
    branches: [main]

jobs:
  izri:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: legendify-dev/izri/apps/github-action@v1
        with:
          api-token: ${{ secrets.IZRI_API_TOKEN }}
```

**`fetch-depth: 0` is not optional.** The scope check compares your head against `origin/<base>`, and a shallow clone has no base ref to compare against. This is the single most common setup failure.

Everything else has a default. `mode` runs both the scope check and a test run, the project is auto-resolved from your git `origin` remote, and the workflow fails when a hard finding appears. See the [GitHub Action reference](/docs/install/github-action) for all eight inputs.

## 3. Open a pull request

Push a branch and open a PR against `main`. The Action runs, and two surfaces light up:

- the `izri/quality` check on the PR, with one child check per signal
- a sticky comment summarizing the verdict, edited in place on each new push

If the run seems stuck, the [troubleshooting guide](/docs/reference/troubleshooting) covers the usual causes.

## 4. Make the check binding

Until you require it, `izri/quality` is advisory — it reports but nothing enforces it.

**Settings → Branches → Branch protection rules → Require status checks to pass**, then add `izri/quality`.

Require the umbrella, not the four children. The umbrella already aggregates them, and requiring children individually means a skipped signal — visual on a backend-only diff, for example — blocks a merge that should sail through.

## Next steps

- [Your first verdict](/docs/start/your-first-verdict) — reading the result.
- [`.izri/scope.yml`](/docs/configure/scope-yml) — tell the scope check what your project considers sensitive.
- [CLI](/docs/install/cli) — run the same checks from your terminal.