CI/CD Integration — AI Agent in Your Pipeline

Your AI agent shouldn't just help during development — it should be part of your pipeline. Auto-review PRs, triage issues, enforce standards. Every commit benefits from the same analysis quality, consistently, without developer overhead.

Three workflows that become automatic with Harness CI/CD:

• PR Review — catch bugs, security issues, and style violations before merge
• Issue Triage — classify severity, suggest labels, and propose fixes automatically
• Standards Enforcement — run custom audits on every push

# From harness.ci.runner
async def run_ci(
    *,
    mode: str | None = None,
    prompt: str | None = None,
    provider: str = "anthropic",
    model: str | None = None,
    sandbox: str = "process",
    check_name: str = "harness-agent",
) -> dict[str, Any]:
    """Run the CI agent. Auto-detects mode from GitHub webhook event if not specified."""

Drop this workflow file into your repository. It triggers on pull requests and new issues, runs Harness in a sandboxed process, and reports results back via Check Runs and PR comments:

name: Harness AI Agent

on:
  pull_request:
    types: [opened, synchronize]
  issues:
    types: [opened]

permissions:
  contents: read
  pull-requests: write
  checks: write
  issues: write

jobs:
  harness:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Harness
        run: |
          pip install uv
          uv tool install harness-agent

      - name: Run Harness Agent
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          harness ci run

Customize prompts, mode behavior, and runtime settings in .harness/ci.yml at the root of your repository:

# .harness/ci.yml
provider: anthropic
model: claude-sonnet-4-20250514
sandbox: process
check_name: harness-agent
max_turns: 30
permission_mode: plan

review_prompt: |
  Review this pull request for:
  1. Code quality and best practices
  2. Security vulnerabilities
  3. Test coverage gaps
  4. Performance concerns
  Provide actionable feedback as PR comments.

issue_prompt: |
  Analyze this issue and:
  1. Classify severity (critical/high/medium/low)
  2. Suggest relevant labels
  3. Identify affected components
  4. Propose a solution approach

When you run harness ci run with no arguments, Harness reads the GitHub webhook payload from the environment and picks the right mode automatically:

# Harness auto-detects the CI context from GitHub webhook events
# PR opened/updated  → review mode
# Issue opened       → issue mode
# Manual             → uses provided prompt

# Automatic mode detection
harness ci run

# Override mode explicitly
harness ci run --mode review

# Custom prompt (overrides ci.yml prompt)
harness ci run --prompt "Run security audit on all changed files"

The full event routing flow:

When a pull request is opened or updated, Harness:

• 1
  Reads the diff via git diff to understand exactly what changed
• 2
  Reads each changed file for full context (not just the diff lines)
• 3
  Posts inline review comments on the PR at the relevant line numbers
• 4
  Creates a GitHub Check Run with a pass or fail status and summary

A typical PR review output looks like this:

# Current (vulnerable)
query = f"SELECT * FROM users WHERE username = '{username}'"

# Suggested fix (parameterized)
query = "SELECT * FROM users WHERE username = %s"
cursor.execute(query, (username,))

When a new issue is opened, Harness analyzes the report, classifies severity, suggests labels, identifies affected components, and proposes a solution approach — all as an issue comment:

Follow this security checklist when setting up Harness in CI:

• 1
  Store API keys as GitHub Secrets (ANTHROPIC_API_KEY) — never hardcode them
• 2
  Use process or docker sandbox mode — never none in CI
• 3
  Set max_turns in .harness/ci.yml to cap how long each CI run can execute
• 4
  Limit permissions scope — only grant what is needed (pull-requests: write)
• 5
  Use read-only permission mode where possible for review-only tasks

# Secure configuration
env:
  ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
  # Never use: ANTHROPIC_API_KEY: "sk-ant-..."

Harness CI works with any pipeline that can run a shell command. Below are ready-to-use configurations for the three most common platforms:

name: Harness AI Agent

on:
  pull_request:
    types: [opened, synchronize]
  issues:
    types: [opened]

permissions:
  contents: read
  pull-requests: write
  checks: write
  issues: write

jobs:
  harness:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Harness
        run: |
          pip install uv
          uv tool install harness-agent

      - name: Run Harness Agent
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          harness ci run

harness-review:
  image: python:3.12
  stage: review
  script:
    - pip install uv && uv tool install harness-agent
    - harness ci run --mode review
  variables:
    ANTHROPIC_API_KEY: $ANTHROPIC_API_KEY
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

pipelines:
  pull-requests:
    '**':
      - step:
          name: Harness AI Review
          image: python:3.12
          script:
            - pip install uv && uv tool install harness-agent
            - harness ci run --mode review

You now have Harness running in CI, automatically reviewing PRs and triaging issues across GitHub, GitLab, and Bitbucket. The next tutorial covers enterprise and production deployment: multi-tenant setups, audit logging, SSO, and self-hosted model configurations.