CI integration

1. Pin the published package

npm install --save-dev --save-exact marucheck@0.5.0
npx --no-install maru init

Commit package.json, package-lock.json, and the reviewed.maru configuration. The workflow uses npm ci andnpx --no-install, so it cannot drift to an unreviewed CLI version.

2. Generate the pull-request workflow

npx --no-install maru ci init
git diff -- .github/workflows/marucheck.yml

Review and commit the generated workflow. Running maru ci init again is idempotent; if the target file contains custom content, MaruCheck refuses to overwrite it.

3. What the generated job does

- name: Install project dependencies
  run: npm ci

- name: Verify changed behavior
  run: npx --no-install maru ci verify

1. Checks out the pull-request revision with read-only permissions.
2. Uses Node.js 24 and the committed npm lockfile.
3. Runs the same planner, adapters, evidence model, and release gate as local verification.
4. Writes a readable GitHub job summary before returning the gate exit code.
5. Uploads hidden .maru evidence even when the gate blocks.

4. Require the gate

After the workflow has run once, add its ProofLayer check to the repository’s branch ruleset if every protected pull request should require MaruCheck. This is a GitHub repository policy; the CLI does not change it automatically.

Evidence and hosted proof

Keep source execution inside the runner. Upload only the artifacts your policy permits, apply a retention period, and avoid placing secrets or raw sensitive payloads in evidence output. To share normalized proof in the dashboard, add the explicit hosted report step separately.