Link your repository

ironhide link puts Ironhide on every pull request (GitHub) or merge request (GitLab) in one step. You approve once in the browser, and Ironhide opens a pull or merge request that adds the CI job. Nothing reaches your default branch until you merge it.

Before you start#

Install the CLI and sign in with ironhide login (a new account proves its email with a one-time code). ironhide setup does this for you and offers link as its last step.
Run it from inside your agent's repository, which needs a GitHub or GitLab remote.

Run it#

ironhide link

It finds your agent and your repository. The CLI runs the same static scan as ironhide discover (it reads your code without importing or running it) and reads your git remote to tell GitHub from GitLab.
It shows a short confirmation code and opens the Ironhide dashboard. Check that the code in the browser matches the one in your terminal, then approve. If Ironhide can't reach this repository yet, approving takes you to GitHub or GitLab first, as part of the same flow (see What Ironhide can access).
Ironhide stores your CI key in the repository. On GitHub it becomes the IRONHIDE_API_KEY repository secret; on GitLab, a masked IRONHIDE_API_KEY CI/CD variable. The key is never written into a file.
Ironhide opens a pull or merge request that adds .ironhide.yml, with your agent already filled in, and the CI job. The terminal waits and prints the link.

Review the pull or merge request, then merge it. From then on, every pull or merge request runs your agent's tests and compares them with your baseline.

If your agent needs a model key#

If your agent calls a model provider (for example it reads OPENAI_API_KEY), CI needs that key too. The pull or merge request lists each one it found, with a direct link to the repository's secrets page. If the gh (GitHub) or glab (GitLab) CLI is installed, ironhide link also offers to set it for you from your local environment. That value goes straight from your machine to GitHub or GitLab and never to Ironhide.

Flags#

Flag	What it does
`--provider github\|gitlab`	Choose the host when it can't be read from your git remote.
`--repo owner/name`	Link a repository other than the one your git remote names.
`--pack`	The action-test scenario pack to record: `general` (default), `fsm`, `crm` or `erp`. See packs.
`--no-browser`	Don't open a browser. The CLI prints the link to open yourself.

What the CI job does#

GitHub: the job runs the GitHub Action on every pull request and on pushes to your default branch, which record the baseline pull requests are compared with.
GitLab: the job runs on every merge request and on pushes to your default branch, which record the baseline, and caches that baseline between pipelines, so GitLab gates the same way GitHub does. See GitLab CI.

Both start in advisory mode: a regression is reported on the pull or merge request without failing the pipeline. Set advisory: false in .ironhide.yml when you're ready for it to block.

What Ironhide can access#

You choose the repositories. Ironhide never gets access to your whole GitHub or GitLab account.

GitHub. You install the Ironhide app on GitHub's own screen and pick Only select repositories (the one you are linking is suggested). The app can only ever reach the repositories you picked there. Each time Ironhide acts, it uses a short-lived token limited to that one repository and to what the setup needs: the files of the pull request, the workflow file, the IRONHIDE_API_KEY secret and one variable. Ironhide stores no GitHub token. To change the list, or remove the app, open the app's settings on GitHub (the console links there).
GitLab. You authorize once. Ironhide uses that authorization only to create a token scoped to the one project you are linking, sets the project up, and revokes your personal authorization right after. It keeps only the project token (it expires within a year; the console offers to renew it) to switch on the nightly schedule. If your GitLab plan doesn't offer project tokens, Ironhide keeps nothing at all and you switch the nightly schedule on yourself.

The console's Action tests page lists exactly which repositories Ironhide can reach, each with Disconnect: that revokes the repository's CI key at once (and, on GitLab, Ironhide's token for the project).

Other ways to connect#

From the dashboard. The console's Action tests page has Connect GitHub (install the app on the repositories you choose, then pick one) and GitLab (name the project, authorize once) that do the same thing without the CLI.
With your own gh / glab. ironhide init --set-secret writes the files locally and stores the secret through the CLI you're already signed in to.
By hand. Follow the GitHub Action or GitLab CI page.