Diagnostics

When a run doesn’t behave as expected, start with the lines the action writes at the top of its log, then the report on the pull request.

Read the plan

The action’s first real step resolves the plan and logs it:

the mode and why it was picked, for example: auto, the repository is public, so the platform can check it out
the target: a deployed URL, or the port of an app on the runner
the timeout-minutes the run needs. Set at least that much on the job

Below the plan, the action warns about inputs that don’t apply to the mode it runs in, and about conflicts such as a port in app_url that differs from app_port. A warning means a setting was ignored, not that the run failed.

Verbose logging

Set verbose: 'true' to log each tool call with its arguments, the tool responses, the prompt and the verdict details:

- uses: ironbee-ai/ironbee-action@v1.1.0
  with:
    ironbee_api_key: ${{ secrets.IRONBEE_API_KEY }}
    app_url: https://preview.example.com
    verbose: 'true'

Common problems

What you see	Why	What to do
The run stops at the plan with “no target”	Neither `app_url` nor `app_start_command` with `app_port` is set	Add a target. See Verifying your application
The run fails before verifying, on a `401` or `403`	The deployment is protected	Pass a bypass in `app_secret_headers`, store it as a project secret, or verify on the runner. See Protected deployments
The report says the run could not read the repository	A private repository that the IronBee GitHub App doesn’t cover	Install the GitHub App on the repository, or set `ironbee_bind_repository: false`
No verification ran with `PROJECT_ARCHIVED`	The project is archived in the console	Unarchive it, or report to another project with `ironbee_project`
No verification ran with `TARGET_OUTSIDE_ENVIRONMENT_DOMAIN`	`app_url` is outside the Domain properties of the environment in `ironbee_environment`	Point `app_url` at a host inside those domains, or change the environment’s domains
No verification ran with `ENVIRONMENT_DOMAIN_NO_TUNNEL`	An app on the runner was verified against an environment that has Domain properties	Verify a deployed URL instead, or use an environment without domains
The run fails with “speaks TLS”	The app on the runner answers with HTTPS	Serve the app over plain HTTP on `app_port`
No verdict	The verification ended without a verdict	Open the run in the console from the report link to see how it ended
The job is cancelled partway	`timeout-minutes` is lower than the run needs	Raise it to the value the plan logs
Session ended early (on your runner)	The agent reached `claude_code_max_turns`, or stopped on an error	Raise `claude_code_max_turns`, or narrow the work with `verification_prompt`
No run on a fork’s pull request	Forks receive no secrets	Expected. Verify after merging, or with a manual dispatch on the branch

Look at a run from your machine

With the IronBee CLI signed in to the same account, check a run on IronBee by its job_id:

ironbee verify status <job_id>

See Verification jobs.

Session logs from your runner

When the verification ran on your runner, the evidence artifact includes the session’s own logs under sessions/<id>/:

verdict.json holds the final verdict.
actions.jsonl is the full event log.

If the agent stopped early, the report shows a banner with a collapsible block: the reason, the turns, errors and any blocked tool calls.

Integrations

GitHub Action

Read the plan

Verbose logging

Common problems

Look at a run from your machine

Session logs from your runner

What’s next?

Evidence

Configuration

​Read the plan

​Verbose logging

​Common problems

​Look at a run from your machine

​Session logs from your runner

​What’s next?

Evidence

Configuration

Read the plan

Verbose logging

Common problems

Look at a run from your machine

Session logs from your runner

What’s next?