Run it on your own machines

That is not modesty about our infrastructure: there is none doing this yet. Analysing code can mean executing it, so scanning somebody else’s repository on our machines needs a sandbox we have specified and not yet built. Until it exists, this is the only path that analyses on a runner, and it is the safer one.

1. 1

   Step 1: Try it on the repository you are standing in

   It prints what it found and exits zero whatever happens — this does not break builds, including its own.

   in a terminal

   copy

   npx mlreps scan .
   npx mlreps check . --dry-run

   --dry-run prints the check run it would post instead of posting it, so you can read what your team would see.

2. 2

   Step 2: Add the workflow

   Into .github/workflows/. The two lines people usually leave out are already in it — the permissions block, without which the job cannot write a check run, and the head commit, without which the check attaches to a merge commit that exists nowhere and the pull request shows nothing.

   .github/workflows/codebase.yml

   copy

   name: Codebase intelligence
   
   on:
     pull_request:
   
   # Without this, GITHUB_TOKEN cannot write a check run and every run ends in a 403.
   permissions:
     contents: read
     checks: write
   
   jobs:
     scan:
       runs-on: ubuntu-latest
       steps:
         - uses: actions/checkout@v4
         - uses: actions/setup-node@v4
           with:
             node-version: 22
         - run: npm ci
         - run: npx mlreps check .
           env:
             GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
             # On a pull request, GITHUB_SHA is a merge commit that exists nowhere in
             # the repository — a check run posted against it is invisible.
             PLATFORM_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
   

What appears, and where