seamlessly, securely on your GitHub

Ways to run it — most install nothing

One engine underneath: identical scans, identical numbers. Only the wrapper changes. The first four below put nothing on anyone's machine.

The GitHub Action — measured on every PR

The headline path: once it's in a team's CI, every pull request is measured — no one has to remember to run anything. Two steps to set up, then it's invisible. New to GitHub Actions? Follow the step-by-step quickstart →

1. Add the workflow file

   Drop ~12 lines into .github/workflows/codedelta.yml. It references the published Action by tag.

2. Open a pull request

   That's it — free and fully unlocked until 31 August 2026 — the free licence is built into the Action, no secrets to add. To run past that date or bring your own license sooner, add a CODEDELTA_LICENSE secret; it overrides the built-in license automatically.

When a developer opens a pull request, GitHub spins up a throwaway Linux machine, downloads the CodeDelta engine, runs the scan against the changed code, and reports back. The runner is then wiped — no install persists, and the code never leaves the customer's own GitHub account. Forks get no secrets (the workflow uses pull_request, never pull_request_target), so a stranger's PR can't exfiltrate your license.

The comment CodeDelta posts on the pull request

Run it without the PR gate — on demand or on a schedule

Don't want it tied to pull requests? Trigger the same job manually from the Actions tab, or on a nightly cron — a one-off scan or a rolling trend, no PR required.

Run it as a container

For environments that won't allow local installs but do allow pulling approved images — which is most hardened corporate CI. One image, runs anywhere Docker runs.

The image carries the compiled engine and everything it needs — no Python setup, no dependencies to resolve. The license is passed in as an environment variable or a mounted file. The same image runs on a laptop, a CI runner, or a self-hosted box, identically.

…in a Jenkins pipeline

Because the image is public and the engine exits 3 on a gated finding, a Jenkins churn gate is one sh step — no plugin, no tool installation on the agent:

Store the base64 licence as a Jenkins secret-text credential. Exit code 3 fails the stage; the HTML and CSV reports land in the workspace for archiving. The same pattern covers GitLab CI, Azure DevOps and Kubernetes-hosted runners — and a K8s CronJob makes it a scheduled scan. Full recipes: Jenkins, Docker and Kubernetes — where measurement fits →

…in GitLab CI

GitLab users get the same merge-request treatment as the GitHub Action — churn + Agent Scan on every MR, reports as job artifacts, an optional MR note — from one ready-made job. Reference it straight from your .gitlab-ci.yml:

Or copy the job in wholesale from code-delta-app/gitlab-ci. Optional variables: CODEDELTA_LICENSE (base64 of your own licence, as a masked CI/CD variable), CODEDELTA_GITLAB_TOKEN (Project Access Token, scope api, enables the MR note), CD_MODE / CD_THRESHOLD.

…or in the browser with Codespaces

Open the repo in a GitHub Codespace and CodeDelta is ready in the terminal — evaluate it on your own code from a browser tab, with nothing installed locally. The Codespace runs on your own GitHub account's compute (within its free allowance), so there's no shared cost or sign-up wall.

The headless CLI

For teams that can install: terminals and cron jobs on any OS — macOS, Windows or Linux. The command is identical everywhere. Point it at two snapshots to measure churn; add a mode for the AI scans.

Licensing built for CI

One RSA-signed license file, verified entirely offline — no phone-home, no account, no network call.

Until 31 August 2026 the GitHub Action needs no license at all — one is built in, fully unlocked. Beyond that: CI machines are different every run, so CodeDelta uses a time-limited license (gated by an expiry date, not locked to a hostname). In CI it lives as a GitHub secret; the Action decodes it to a file at runtime — and it overrides the built-in license automatically. The same license works in a container, on a developer's laptop, a build server, or a cron host — wherever the engine finds a CODEDELTA_LICENSE path, it uses it. The downloadable bundle is public; the license gates execution, not download.