---
title: "CI/CD Automation"
source: https://docs.autohand.ai/guides/ci-cd-automation
---

# CI/CD Automation

Integrate Autohand into your CI/CD pipelines for automated code reviews, testing analysis, and deployment assistance.

**Related Skills:** Supercharge your CI/CD pipelines with specialized skills from [Skilled](https://skilled.autohand.ai). Browse [DevOps automation skills](https://skilled.autohand.ai/categories/devops), [CI/CD workflows](https://skilled.autohand.ai/categories/workflows), and [testing and quality skills](https://skilled.autohand.ai/categories/quality) for your automation needs.

## Overview

Autohand's headless mode enables powerful automation in CI/CD environments. Combined with Agent Skills, you can create sophisticated workflows that:

-   Review pull requests automatically before merge
-   Analyze test failures and suggest fixes
-   Generate release notes from commit history
-   Validate code against security policies
-   Run E2E tests with AI-powered analysis

## Setup

### Install Autohand in CI

Add Autohand to your CI environment:

``` bash
# Install via npm
npm i -g autohand-cli

# Or via curl
curl -fsSL https://autohand.ai/install.sh | bash
```

### Configure authentication

Set your API key as a secret environment variable:

``` yaml
# GitHub Actions example
env:
  AUTOHAND_API_KEY: ${{ secrets.AUTOHAND_API_KEY }}
```

**Security:** Never commit API keys to your repository. Always use your CI provider's secret management.

## Headless mode

Headless mode runs Autohand without interactive prompts, perfect for automation:

``` bash
# Basic headless execution
autohand --headless --prompt "Your task here"

# With auto-confirm for file changes
autohand --headless --yes --prompt "Fix all TypeScript errors"

# Restricted mode (read-only, no file changes)
autohand --headless --restricted --prompt "Review this code for issues"
```

### Headless options

| Flag | Description |
|---|---|
| --headless | Run without interactive prompts |
| --yes | Auto-confirm all actions |
| --restricted | Read-only mode, no file modifications |
| --unrestricted | Allow all operations without confirmation |
| --dry-run | Preview changes without applying |
| --output json | Output results as JSON for parsing |

## GitHub Actions

### Automated PR review

Review pull requests automatically when opened:

``` yaml
# .github/workflows/autohand-review.yml
name: Autohand PR Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Autohand
        run: npm i -g autohand-cli

      - name: Review PR
        env:
          AUTOHAND_API_KEY: ${{ secrets.AUTOHAND_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git diff origin/main...HEAD | autohand --headless --restricted \
            --prompt "Review this diff for bugs, security issues, and code quality. Output as markdown."

```

### Test failure analysis

Analyze failed tests and suggest fixes:

``` yaml
# .github/workflows/test-analysis.yml
name: Test Analysis

on:
  workflow_run:
    workflows: ["Tests"]
    types: [completed]

jobs:
  analyze:
    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Autohand
        run: npm i -g autohand-cli

      - name: Analyze failures
        env:
          AUTOHAND_API_KEY: ${{ secrets.AUTOHAND_API_KEY }}
        run: |
          npm test 2>&1 | autohand --headless --restricted \
            --prompt "Analyze these test failures and suggest specific fixes"

```

### Release notes generation

``` yaml
# .github/workflows/release-notes.yml
name: Generate Release Notes

on:
  release:
    types: [created]

jobs:
  notes:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Autohand
        run: npm i -g autohand-cli

      - name: Generate notes
        env:
          AUTOHAND_API_KEY: ${{ secrets.AUTOHAND_API_KEY }}
        run: |
          autohand --headless --restricted \
            --prompt "Generate release notes from commits since the last tag. Format as markdown with sections for Features, Fixes, and Breaking Changes." \
            > release-notes.md

```

## Using Skills in CI

Agent Skills make CI tasks reusable and consistent. Add project Skills to `.autohand/skills/`:

### E2E testing Skill

``` yaml
# .autohand/skills/e2e-analysis/SKILL.md
---
name: e2e-analysis
description: Analyze E2E test results and failures. Use after running Playwright or Cypress tests.
allowed-tools: read_file search run_command
---

# E2E Test Analysis

## When to use
- After E2E test failures in CI
- When investigating flaky tests
- For test coverage analysis

## Workflow
1. Read the test output and identify failures
2. Search for related test files
3. Analyze the failure patterns
4. Suggest specific fixes or improvements

## Output format
Provide analysis in this format:
- **Failed tests**: List each failing test
- **Root cause**: What's causing the failure
- **Suggested fix**: Specific code changes needed
- **Prevention**: How to prevent similar failures
```

### Use Skills in workflows

``` yaml
# GitHub Actions workflow
- name: Analyze E2E failures
  run: |
    npx playwright test 2>&1 | autohand --headless --restricted \
      --skill e2e-analysis \
      --prompt "Analyze these E2E test results"
```

### Security audit Skill

``` yaml
# .autohand/skills/security-audit/SKILL.md
---
name: security-audit
description: Audit code for security vulnerabilities. Use for PR reviews and security checks.
allowed-tools: read_file search
---

# Security Audit

## Check for
- SQL injection vulnerabilities
- XSS attack vectors
- Authentication bypass
- Insecure dependencies
- Hardcoded secrets
- OWASP Top 10 issues

## Output format
- **Severity**: Critical / High / Medium / Low
- **Location**: File and line number
- **Issue**: Description of the vulnerability
- **Fix**: How to remediate
```

## GitLab CI

``` yaml
# .gitlab-ci.yml
stages:
  - review
  - test

autohand-review:
  stage: review
  image: node:20
  before_script:
    - npm i -g autohand-cli
  script:
    - git diff origin/main...HEAD | autohand --headless --restricted
        --prompt "Review this diff for issues"
  variables:
    AUTOHAND_API_KEY: $AUTOHAND_API_KEY
  only:
    - merge_requests

test-analysis:
  stage: test
  image: node:20
  before_script:
    - npm i -g autohand-cli
  script:
    - npm test 2>&1 | autohand --headless --restricted
        --prompt "Analyze test results"
  variables:
    AUTOHAND_API_KEY: $AUTOHAND_API_KEY
  when: on_failure
```

## Jenkins

``` groovy
// Jenkinsfile
pipeline {
    agent any

    environment {
        AUTOHAND_API_KEY = credentials('autohand-api-key')
    }

    stages {
        stage('Install') {
            steps {
                sh 'npm i -g autohand-cli'
            }
        }

        stage('Review') {
            when {
                changeRequest()
            }
            steps {
                sh '''
                    git diff origin/main...HEAD | autohand --headless --restricted \
                        --prompt "Review this PR for code quality issues"
                '''
            }
        }

        stage('Test Analysis') {
            steps {
                script {
                    def testResult = sh(
                        script: 'npm test 2>&1',
                        returnStatus: true
                    )
                    if (testResult != 0) {
                        sh '''
                            npm test 2>&1 | autohand --headless --restricted \
                                --prompt "Analyze these test failures"
                        '''
                    }
                }
            }
        }
    }
}
```

## Best practices

### Security

-   **Use restricted mode for reviews:** Prevents unintended file modifications
-   **Never expose API keys:** Use CI secret management
-   **Limit permissions:** Run with minimal required permissions
-   **Audit outputs:** Review Autohand suggestions before auto-merging

### Performance

-   **Cache Autohand installation:** Speed up CI runs with caching
-   **Use specific prompts:** Focused prompts run faster
-   **Parallelize where possible:** Run independent checks concurrently

### Reliability

-   **Handle failures gracefully:** Don't block pipelines on Autohand errors
-   **Set timeouts:** Prevent hanging jobs
-   **Use dry-run first:** Test workflows with `--dry-run` before enabling

## Quick examples

### One-liners for CI

``` bash
# Review staged changes
git diff --staged | autohand --headless --restricted --prompt "Review for bugs"

# Analyze test output
npm test 2>&1 | autohand --headless --restricted --prompt "Explain failures"

# Generate changelog
autohand --headless --prompt "Generate changelog since v1.0.0" > CHANGELOG.md

# Security scan
autohand --headless --restricted --skill security-audit --prompt "Audit src/ for vulnerabilities"

# Documentation check
autohand --headless --restricted --prompt "Check if docs match the code in src/api/"

# Lint fix suggestions
npm run lint 2>&1 | autohand --headless --restricted --prompt "Suggest fixes for these lint errors"
```

## Next steps

[Agent Skills](/docs/working-with-autohand-code/agent-skills.html) - Create reusable Skills for CI workflows

[Headless Mode](/docs/working-with-autohand-code/headless-mode.html) - Full headless mode reference

[Autonomous SRE](/docs/guides/autonomous-sre.html) - Automated incident response

[GitHub Integration](/docs/integrations/github.html) - Native GitHub app features