Sync Checks in CI

Part of Sync.

Check Every Pull Request

Create .github/workflows/cedr.yml after committing .cedr/ and its generated files:

name: cedr checks
on: [push, pull_request]
permissions:
  contents: read
jobs:
  sync:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: Sheernox/cedr@v0.5.0
        with:
          sync: 'true'

This runs checks without an organization upload. The shared action also runs Guard lint, checks a Guard lock when one exists, and checks server updates. Review that scope before adopting it.

The action runs cedr sync check when the repo has .cedr/sync.toml (input sync: auto, true or false), alongside Guard’s checks. To have drift repaired for you, add a scheduled workflow with sync-fix: true, contents: write and pull-requests: write permissions and GH_TOKEN: ${{ github.token }}: it runs cedr sync and opens a pull request when files changed. It never runs on pull requests from forks.

Separate Checks From Repairs

Run ordinary pull request checks with read-only repository permissions. push-org and CEDR_API_KEY are optional; omit both when you only want local CI findings. Do not expose a write key to untrusted fork code.

Use a separate scheduled or manually dispatched workflow for sync-fix. Review the resulting pull request before merging it; generated changes can reflect organization policy updates as well as local rules. The Guard action reference lists all shared inputs.

A check validates the cached organization rules in the repository. Pull and commit new rules through Organization Rules and Reports when you want to adopt a newer version.