tool-containers
Search docs…Ctrl K
Menu
GitHub (opens in new tab)

Run Pi Coding Agent with GitHub Actions

workflow.yml reviews each pull request with Pi and writes the review to the job summary. It pipes the diff into pi --print --no-session, limited to the read, grep, find, and ls tools.

Images
  • GHCRghcr.io/hambn/pi-agent
  • Docker Hubdocker.io/hambn/pi-agent
Use case
Code review in CI on GitHub pull requests
Upstream
github.com/earendil-works/pi (opens in new tab)
Source
tools/ai/pi-agent/docs/github-actions (opens in new tab)
On this page

Prerequisites

Set up

Shell
mkdir -p .github/workflows
cp workflow.yml .github/workflows/pi-agent-review.yml

It runs on every pull request opened from a branch of the same repository.

The workflow runs ghcr.io/hambn/pi-agent:ubuntu. Replace the tag with @sha256:<digest> to pin one build.

Variables

Variable Required Purpose
ANTHROPIC_API_KEY yes Repository secret: Anthropic API key, passed to the review step only. Pi also reads other providers' keys, such as OPENAI_API_KEY.

Workspace

The runner checks out the pull request merge commit and its first parent. The review container mounts the checkout read-only at /workspace and runs as sysadmin (UID 1000); it does not receive the job's GitHub token.

Files

Limitations

  • Pull requests from forks are skipped, because GitHub does not pass secrets to workflows they trigger.
  • The review is advisory: the job does not comment on the pull request or fail on findings. Read it in the job summary.
  • The diff is untrusted model input. The step has a read-only mount and no GitHub token, which limits what a crafted change can make the agent do.
  • Pi picks a default model for the provider whose key is set; add --model <provider>/<id> to choose one.

File contents

workflow.yml40 lines
# Copy to .github/workflows/pi-agent-review.yml and add an ANTHROPIC_API_KEY repository secret.
name: pi-agent review

on:
  pull_request:

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  review:
    name: Review with Pi
    # GitHub does not pass secrets to workflows triggered from forks, so skip those pull requests.
    if: github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # The pull request merge commit and its first parent, the base branch, cover the diff.
          fetch-depth: 2
          persist-credentials: false
      - name: Review
        # An explicit bash shell adds pipefail, so a failed git diff fails the step.
        shell: bash
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          # Read-only tools let Pi inspect the checkout without editing files or running commands.
          git diff HEAD^1 HEAD |
            docker run --rm -i -e ANTHROPIC_API_KEY \
              -v "$GITHUB_WORKSPACE:/workspace:ro" \
              ghcr.io/hambn/pi-agent:ubuntu \
              --print --no-session --tools read,grep,find,ls "Review this pull request diff for bugs, security issues, and missing tests. Reply in Markdown." \
            >> "$GITHUB_STEP_SUMMARY"

Topics