GitHub Actions Integration

Sigil’s GitHub Actions integration evaluates a pull request, compares it with the baseline, posts a status check, and can enqueue safe PRs when a service has earned AUTO trust.

What it does

sigil ci owner/repo#42 --service api --comment --auto-merge

The command runs:

1. sigil eval against the PR ref and merge-base baseline.
2. sigil decide to resolve ALLOW, REVIEW, or BLOCK.
3. A GitHub commit status with a link to the eval report.
4. Optional lossy PR feedback for the authoring agent.
5. Optional merge queue enqueue on ALLOW when trust is AUTO.

Minimal workflow

name: sigil
on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  evaluate:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      statuses: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install sigil
        run: curl -fsSL https://runsigil.com/install.sh | sh
      - name: Evaluate
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SIGIL_SCENARIOS_KEY: ${{ secrets.SIGIL_SCENARIOS_KEY }}
        run: |
          sigil ci ${{ github.repository }}#${{ github.event.pull_request.number }} \
            --service api \
            --comment \
            --auto-merge

Required permissions

Permission	Why
contents: read	Checkout and resolve refs.
statuses: write	Publish the Sigil decision as a commit status.
pull-requests: write	Post optional lossy feedback comments.

Branch protection

Require the sigil/<service> status check on protected branches after the service has been calibrated. While a service is still in SHADOW, use Sigil as a non-blocking signal and compare decisions with human review outcomes.

Troubleshooting

Symptom	Check
No status appears	Confirm statuses: write permission and the ref passed to sigil ci.
PR comment fails	Confirm pull-requests: write permission.
Holdouts do not run	Confirm SIGIL_SCENARIOS_KEY is present in repository or environment secrets.
Merge queue does not enqueue	Confirm the service is in AUTO trust and branch protection allows queue enqueue.

For setup help, email [email protected] with the workflow file, Sigil version, and sanitized command output.

More detail

Read the full CI Integration guide for config options and command flags.