seamlessly, securely on your GitHub

Ways to run it — most install nothing

One engine underneath: identical scans, identical numbers. Only the wrapper changes. The first four below put nothing on anyone's machine.

The GitHub Action — measured on every PR

The headline path: once it's in a team's CI, every pull request is measured — no one has to remember to run anything. Two steps to set up, then it's invisible. New to GitHub Actions? Follow the step-by-step quickstart →

1. Add the workflow file

   Drop ~12 lines into .github/workflows/codedelta.yml. It references the published Action by tag.

2. Open a pull request

   That's it — free and fully unlocked until 31 December 2026 — the free licence is built into the Action, no secrets to add. To run past that date or bring your own license sooner, add a CODEDELTA_LICENSE secret; it overrides the built-in license automatically.

When a developer opens a pull request, GitHub spins up a throwaway Linux machine, downloads the CodeDelta engine, runs the scan against the changed code, and reports back. The runner is then wiped — no install persists, and the code never leaves the customer's own GitHub account. Forks get no secrets (the workflow uses pull_request, never pull_request_target), so a stranger's PR can't exfiltrate your license.

The comment CodeDelta posts on the pull request

Run it without the PR gate — on demand or on a schedule

Don't want it tied to pull requests? Trigger the same job manually from the Actions tab, or on a nightly cron — a one-off scan or a rolling trend, no PR required.

Run it as a container

For environments that won't allow local installs but do allow pulling approved images — which is most hardened corporate CI. One image, runs anywhere Docker runs.

The image carries the compiled engine and everything it needs — no Python setup, no dependencies to resolve. The license is passed in as an environment variable or a mounted file. The same image runs on a laptop, a CI runner, or a self-hosted box, identically.

…in a Jenkins pipeline

Because the image is public and the engine exits 3 on a gated finding, a Jenkins churn gate is one sh step — no plugin, no tool installation on the agent:

Store the base64 licence as a Jenkins secret-text credential. Exit code 3 fails the stage; the HTML and CSV reports land in the workspace for archiving. The same pattern covers GitLab CI, Azure DevOps and Kubernetes-hosted runners — and a K8s CronJob makes it a scheduled scan. Full recipes: Jenkins, Docker and Kubernetes — where measurement fits →

…in GitLab CI

GitLab users get the same merge-request treatment as the GitHub Action — churn + Agent Scan on every MR, reports as job artifacts, an optional MR note — from one ready-made job. Reference it straight from your .gitlab-ci.yml:

Or copy the job in wholesale from code-delta-app/gitlab-ci. Optional variables: CODEDELTA_LICENSE (base64 of your own licence, as a masked CI/CD variable), CODEDELTA_GITLAB_TOKEN (Project Access Token, scope api, enables the MR note), CD_MODE / CD_THRESHOLD.

…or in the browser with Codespaces

Open the repo in a GitHub Codespace and CodeDelta is ready in the terminal — evaluate it on your own code from a browser tab, with nothing installed locally. The Codespace runs on your own GitHub account's compute (within its free allowance), so there's no shared cost.

The headless CLI

For teams that can install: terminals and cron jobs on any OS — macOS, Windows or Linux. The command is identical everywhere. Point it at two snapshots to measure churn; add a mode for the AI scans. The full command-line story — every mode, the weekly cron loop and the output files — has its own page.

Licensing built for CI

One RSA-signed license file, verified entirely offline — no phone-home, no account, no network call.

Until 31 December 2026 the GitHub Action needs no license at all — one is built in, fully unlocked. Beyond that: CI machines are different every run, so CodeDelta uses a time-limited license (gated by an expiry date, not locked to a hostname). In CI it lives as a GitHub secret; the Action decodes it to a file at runtime — and it overrides the built-in license automatically. The same license works in a container, on a developer's laptop, a build server, or a cron host — wherever the engine finds a CODEDELTA_LICENSE path, it uses it. The downloadable bundle is public; the license gates execution, not download.