The run, step by step
Every run is a single composite job that sets up the toolchain, verifies, and reports:Install
Pins and installs
@ironbee-ai/cli, @anthropic-ai/claude-code, @ironbee-ai/devtools, and Playwright Chromium (cached across runs).Configure
Writes
.ironbee/config.json with the collector URL and per-mode DevTools flags, then runs ironbee install --client claude to wire up hooks, skills, rules, and MCP config. Your API key is passed as an env var, never written to disk.Prompt
Builds a verification prompt tailored to the trigger diff-based for pushes and PRs, full-application for manual and scheduled runs.
Verify
Runs Claude Code with
/ironbee-verify, which exercises the change through each enabled DevTools mode and submits a verdict.The completion gate
Verification is enforced by the same completion gate the CLI installs, see How Verification Works for the full mechanism. In CI, the action instructs the agent to run/ironbee-verify, fix any issues it finds, and re-verify. The gate is what makes that meaningful: each cycle defines the tools that must appear on the wire before a pass counts, so the agent can’t declare success without actually exercising the change.
The verdict
To pass, the agent exercises the affected paths and submits a verdict:pass, fail, or unknown with the checks it ran, issues it found, and fixes it applied. The action surfaces the final verdict two ways:
- As the
verdictoutput you can branch on in later workflow steps. - As a badge at the top of the PR report.
Verification scope
The prompt the action builds depends on what triggered it:| Scope | When | What the agent verifies |
|---|---|---|
| Focused | pull_request, push | Only the areas affected by the diff |
| Full | workflow_dispatch, schedule | The entire application, no diff required |
Fix behavior
When verification produces fixes, where they land depends on the trigger:- Pull request fixes are committed directly to the PR branch and the agent re-verifies.
- Push, manual, scheduled fixes are moved to a new branch and opened as a fix PR; the original ref is left untouched.
Sessions and recording
Each run is recorded as a session to the IronBee collector and shows up in the Console, with the full timeline, recordings, and per-cycle verdicts. Locally, the same data is written under.ironbee/sessions/<id>/ and collected into the uploaded evidence artifact. The PR report links straight to the session and to each verification cycle in the Console.
What’s next?
Running in CI
How scope, fix behavior, and the PR report change per event.
Evidence
What the action records and uploads after a run.