Run Pi Coding Agent with GitLab CI

Prerequisites#

• A GitLab project with a runner that uses the Docker executor, such as GitLab.com hosted Linux runners.
• A masked ANTHROPIC_API_KEY CI/CD variable (opens in new tab).

Set up#

Add the pi-agent-review job to your project's .gitlab-ci.yml. It runs only in merge request pipelines.

The job runs ghcr.io/hambn/pi-agent:ubuntu. Replace the tag with @sha256:<digest> to pin one build.

Variables#

Workspace#

The runner clones the full history (GIT_DEPTH: "0") into $CI_PROJECT_DIR and runs the script as the image user, sysadmin (UID 1000). The clone belongs to a different user, so the first script line marks it as a Git safe directory. The job clears the image's pi entrypoint because the runner passes a shell as the command. The review covers $CI_MERGE_REQUEST_DIFF_BASE_SHA to HEAD.

Files#

• gitlab-ci.yml: merge request review job.

Limitations#

• Merge request pipelines that run in a fork do not get the parent project's CI/CD variables, so the job stops at the variable check.
• The review is advisory: the job does not comment on the merge request or fail on findings. Read it in the job log.
• The diff is untrusted model input, and the job environment, including CI_JOB_TOKEN, is visible to any command the agent runs.
• Pi picks a default model for the provider whose key is set; add --model <provider>/<id> to choose one.

# Add this job to your project's .gitlab-ci.yml and set ANTHROPIC_API_KEY as a masked CI/CD variable.
pi-agent-review:
  image:
    name: ghcr.io/hambn/pi-agent:ubuntu
    # The runner passes a shell as the command, so clear the image's CLI entrypoint.
    entrypoint: [""]
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    # A full clone keeps the merge request's diff base commit available.
    GIT_DEPTH: "0"
  timeout: 30m
  script:
    # The runner clones as a different user than sysadmin, so Git needs the path marked safe.
    - git config --global --add safe.directory "$CI_PROJECT_DIR"
    - ': "${ANTHROPIC_API_KEY:?Set ANTHROPIC_API_KEY as a masked CI/CD variable}"'
    - git diff "$CI_MERGE_REQUEST_DIFF_BASE_SHA" HEAD | pi --print --no-session --tools read,grep,find,ls "Review this merge request diff for bugs, security issues, and missing tests."