Guard Checks in CI

Part of Guard.

Check Every Pull Request

Create .github/workflows/cedr.yml with a read-only check workflow. Commit the reviewed Guard lock and surfaces before enabling verification:

name: cedr checks
on: [push, pull_request]
permissions:
  contents: read
jobs:
  guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: Sheernox/cedr@v0.5.0
        with:
          verify: 'true'
          sync: 'false'

This installs the CLI and runs lint and verification, with findings shown as annotations. It does not upload reports. Remove sync: 'false' if you also want the action to check a repository configured with Sync.

To report results to the app, add push-org: <organization ID> under with and CEDR_API_KEY: ${{ secrets.CEDR_API_KEY }} under the action step’s env. Store the key as a repository secret yourself. Do not expose it to untrusted fork code; fork checks can run without uploads.

Action Inputs

Input	Default	What it does
version	the action’s version	The cedr release to install
path	.	The folder to check
strict	false	Fail on warnings as well as errors
verify	auto	auto checks against the lock when there is one; true requires a lock; false skips the check
push-org	none	Your organization ID; with an API key in CEDR_API_KEY, the action sends each result to the Guard page (and the Sync page when the repo uses Sync), even when the checks fail
outdated	true	Shows newer versions of pinned servers as warnings; never fails the job
sync	auto	Runs Sync’s check when the repo has .cedr/sync.toml; true requires it; false skips it
sync-fix	false	On push, scheduled or manual runs, regenerates Sync’s files and opens a pull request when they changed

The action also runs cedr outdated (input outdated, default true) so newer versions show as warnings without failing the job, and with push-org sends them to the app. It never runs the servers it checks.