Using CXGRD in CI workflows

CXGRD is designed for teams using AI-assisted development. It makes the likely impact of a change visible during review so maintainers can investigate high-risk changes before merging.

What the action does

The action performs these steps in the repository workspace:

1. Installs the repository's dependencies.
2. Installs the CXGRD CLI globally.
3. Builds or refreshes the dependency graph with cxgrd scan.
4. Runs cxgrd check --json.
5. Creates or updates a pull request comment with the risk level and affected files.

The comment is updated on subsequent workflow runs instead of creating a new comment each time.

Quick start

Create .github/workflows/cxgrd.yml:

name: CXGRD

on:
	pull_request:

permissions:
	contents: read
	issues: write
	pull-requests: write

jobs:
	cxgrd:
		name: Analyze blast radius
		runs-on: ubuntu-latest
		steps:
			- name: install dependencies
				run: <install command (npm/pip/cargo)>
			- name: install cxgrd
				run: npm install -g cxgrd
			- name: Run cxgrd scan
				uses: cxgrd/cxgrd-action@main
				run: cxgrd scan
			- name: Run cxgrd check
				uses: cxgrd/cxgrd-action@main
				run: cxgrd check

Add the install command in the yaml script according to the programming language used.

Inputs

The action runs the standard cxgrd check --json command. The token and fail-on inputs are exposed for CI enforcement support.

The CI enforcement requires CXGRD Team

Authentication

Authentication is optional for the local structural and compiler checks. For Team-plan CI enforcement, provide the token from team dashboard:

- name: Run CXGRD
	uses: cxgrd/cxgrd-action@main
	with:
		token: ${{ secrets.CXGRD_TOKEN }}
		fail-on: high

Do not hard-code tokens in workflow files. Create CXGRD_TOKEN under Settings > Secrets and variables > Actions.

Read more about Team CI here

Repository requirements

• The analyzed directory must contain a valid package-lock.json, because the action runs npm ci there.
• working-directory must contain the repository's package.json and package-lock.json when analyzing a repository fixture or checkout in a subdirectory.
• The checkout should include full history (fetch-depth: 0) because the current CLI compares changes with origin/main.
• The runner must have Node.js and npm available. ubuntu-latest provides both.
• The workflow must check out the repository before invoking the action.
• Pull request comment permissions are required for the reporting step. If the repository uses restricted fork permissions, configure the workflow permissions and event policy accordingly.

Pull request permissions

The included reporting step uses the GitHub API to list, update, and create issue comments. These permissions are sufficient for the standard pull request workflow:

permissions:
	contents: read
	issues: write
	pull-requests: write

For workflows running on pull_request from forks, GitHub may reduce the available write permissions. Review your repository's fork and security settings before enabling comment updates for untrusted code.