Running in CI

The CLI runs the same scan and hearing from any pipeline, for teams that would rather not install an app on their Git host.

GitHub Actions

name: review
on: [pull_request]

jobs:
  dicast:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      checks: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0     # the panel needs history for context
      - uses: dicast/review-action@v1
        with:
          token: ${{ secrets.DICAST_TOKEN }}

Any other CI

npx @dicast/cli review \
  --base origin/main \
  --head HEAD \
  --config .dicast.yml \
  --format sarif > dicast.sarif

Output formats: text for logs, json for your own tooling, and sarif for code-scanning dashboards that already ingest it. The exit code is non-zero when a finding reaches block_at, so the pipeline step fails exactly when the merge gate would.

What you lose

• Inline comments require a token with write access to pull requests; without one the CLI reports to stdout only.
• @dicast commands need the app — a pipeline cannot listen for comments.
• Dismissal learning is per workspace and still works, but only if the CLI is authenticated to one.