CI/CD Automation - Autohand Docs

Overview

Autohand's headless mode enables powerful automation in CI/CD environments. Combined with Agent Skills, you can create sophisticated workflows that:

Review pull requests automatically before merge
Analyze test failures and suggest fixes
Generate release notes from commit history
Validate code against security policies
Run E2E tests with AI-powered analysis

Setup

Install Autohand in CI

Add Autohand to your CI environment:

# Install via npm
npm i -g autohand-cli

# Or via curl
curl -fsSL https://autohand.ai/install.sh | bash

Configure authentication

Set your API key as a secret environment variable:

# GitHub Actions example
env:
  AUTOHAND_API_KEY: ${{ secrets.AUTOHAND_API_KEY }}

Security: Never commit API keys to your repository. Always use your CI provider's secret management.

Headless mode

Headless mode runs Autohand without interactive prompts, perfect for automation:

# Basic headless execution
autohand --headless --prompt "Your task here"

# With auto-confirm for file changes
autohand --headless --yes --prompt "Fix all TypeScript errors"

# Restricted mode (read-only, no file changes)
autohand --headless --restricted --prompt "Review this code for issues"

Headless options

Flag	Description
`--headless`	Run without interactive prompts
`--yes`	Auto-confirm all actions
`--restricted`	Read-only mode, no file modifications
`--unrestricted`	Allow all operations without confirmation
`--dry-run`	Preview changes without applying
`--output json`	Output results as JSON for parsing

GitHub Actions

Automated PR review

Review pull requests automatically when opened:

# .github/workflows/autohand-review.yml
name: Autohand PR Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Autohand
        run: npm i -g autohand-cli

      - name: Review PR
        env:
          AUTOHAND_API_KEY: ${{ secrets.AUTOHAND_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          git diff origin/main...HEAD | autohand --headless --restricted \
            --prompt "Review this diff for bugs, security issues, and code quality. Output as markdown."

Test failure analysis

Analyze failed tests and suggest fixes:

# .github/workflows/test-analysis.yml
name: Test Analysis

on:
  workflow_run:
    workflows: ["Tests"]
    types: [completed]

jobs:
  analyze:
    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Autohand
        run: npm i -g autohand-cli

      - name: Analyze failures
        env:
          AUTOHAND_API_KEY: ${{ secrets.AUTOHAND_API_KEY }}
        run: |
          npm test 2>&1 | autohand --headless --restricted \
            --prompt "Analyze these test failures and suggest specific fixes"

Release notes generation

# .github/workflows/release-notes.yml
name: Generate Release Notes

on:
  release:
    types: [created]

jobs:
  notes:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Autohand
        run: npm i -g autohand-cli

      - name: Generate notes
        env:
          AUTOHAND_API_KEY: ${{ secrets.AUTOHAND_API_KEY }}
        run: |
          autohand --headless --restricted \
            --prompt "Generate release notes from commits since the last tag. Format as markdown with sections for Features, Fixes, and Breaking Changes." \
            > release-notes.md

Using Skills in CI

Agent Skills make CI tasks reusable and consistent. Add project Skills to .autohand/skills/:

E2E testing Skill

# .autohand/skills/e2e-analysis/SKILL.md
---
name: e2e-analysis
description: Analyze E2E test results and failures. Use after running Playwright or Cypress tests.
allowed-tools: read_file search run_command
---

# E2E Test Analysis

## When to use
- After E2E test failures in CI
- When investigating flaky tests
- For test coverage analysis

## Workflow
1. Read the test output and identify failures
2. Search for related test files
3. Analyze the failure patterns
4. Suggest specific fixes or improvements

## Output format
Provide analysis in this format:
- **Failed tests**: List each failing test
- **Root cause**: What's causing the failure
- **Suggested fix**: Specific code changes needed
- **Prevention**: How to prevent similar failures

Use Skills in workflows

# GitHub Actions workflow
- name: Analyze E2E failures
  run: |
    npx playwright test 2>&1 | autohand --headless --restricted \
      --skill e2e-analysis \
      --prompt "Analyze these E2E test results"

Security audit Skill

# .autohand/skills/security-audit/SKILL.md
---
name: security-audit
description: Audit code for security vulnerabilities. Use for PR reviews and security checks.
allowed-tools: read_file search
---

# Security Audit

## Check for
- SQL injection vulnerabilities
- XSS attack vectors
- Authentication bypass
- Insecure dependencies
- Hardcoded secrets
- OWASP Top 10 issues

## Output format
- **Severity**: Critical / High / Medium / Low
- **Location**: File and line number
- **Issue**: Description of the vulnerability
- **Fix**: How to remediate

GitLab CI

# .gitlab-ci.yml
stages:
  - review
  - test

autohand-review:
  stage: review
  image: node:20
  before_script:
    - npm i -g autohand-cli
  script:
    - git diff origin/main...HEAD | autohand --headless --restricted
        --prompt "Review this diff for issues"
  variables:
    AUTOHAND_API_KEY: $AUTOHAND_API_KEY
  only:
    - merge_requests

test-analysis:
  stage: test
  image: node:20
  before_script:
    - npm i -g autohand-cli
  script:
    - npm test 2>&1 | autohand --headless --restricted
        --prompt "Analyze test results"
  variables:
    AUTOHAND_API_KEY: $AUTOHAND_API_KEY
  when: on_failure

Jenkins

// Jenkinsfile
pipeline {
    agent any

    environment {
        AUTOHAND_API_KEY = credentials('autohand-api-key')
    }

    stages {
        stage('Install') {
            steps {
                sh 'npm i -g autohand-cli'
            }
        }

        stage('Review') {
            when {
                changeRequest()
            }
            steps {
                sh '''
                    git diff origin/main...HEAD | autohand --headless --restricted \
                        --prompt "Review this PR for code quality issues"
                '''
            }
        }

        stage('Test Analysis') {
            steps {
                script {
                    def testResult = sh(
                        script: 'npm test 2>&1',
                        returnStatus: true
                    )
                    if (testResult != 0) {
                        sh '''
                            npm test 2>&1 | autohand --headless --restricted \
                                --prompt "Analyze these test failures"
                        '''
                    }
                }
            }
        }
    }
}

Best practices

Security

Use restricted mode for reviews: Prevents unintended file modifications
Never expose API keys: Use CI secret management
Limit permissions: Run with minimal required permissions
Audit outputs: Review Autohand suggestions before auto-merging

Performance

Cache Autohand installation: Speed up CI runs with caching
Use specific prompts: Focused prompts run faster
Parallelize where possible: Run independent checks concurrently

Reliability

Handle failures gracefully: Don't block pipelines on Autohand errors
Set timeouts: Prevent hanging jobs
Use dry-run first: Test workflows with --dry-run before enabling

Quick examples

One-liners for CI

# Review staged changes
git diff --staged | autohand --headless --restricted --prompt "Review for bugs"

# Analyze test output
npm test 2>&1 | autohand --headless --restricted --prompt "Explain failures"

# Generate changelog
autohand --headless --prompt "Generate changelog since v1.0.0" > CHANGELOG.md

# Security scan
autohand --headless --restricted --skill security-audit --prompt "Audit src/ for vulnerabilities"

# Documentation check
autohand --headless --restricted --prompt "Check if docs match the code in src/api/"

# Lint fix suggestions
npm run lint 2>&1 | autohand --headless --restricted --prompt "Suggest fixes for these lint errors"

Next steps

Agent Skills Create reusable Skills for CI workflows Headless Mode Full headless mode reference Autonomous SRE Automated incident response GitHub Integration Native GitHub app features