ironbee-ai/IronBee Action

Verify and fix code changes using IronBee CLI + Claude Code

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit May 19, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: ironbee-ai/ironbee-action@711f9e8d53d7fb8b0f1e6abf89bf15011db19c52 # v1

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
verification_mode	Where the verification runs — one of: auto, platform, local. "platform" starts a verification job on the IronBee platform and follows it; "local" runs the agent on this runner with your own Anthropic credential; "auto" picks platform for a public repository, and local for a private one when an Anthropic credential is set (set "platform" explicitly if the IronBee GitHub App covers it).	no	auto
ironbee_api_key	IronBee API key. Authenticates the collector, and the platform API in platform mode.	yes	—
ironbee_api_url	IronBee API base URL. Empty uses the CLI default.	no	""
ironbee_collector_url	IronBee collector endpoint URL. Empty uses the CLI default — and leaving it empty is what lets the CLI resolve every other service URL to the same stage, since an explicit one here is how it infers which stage that is.	no	""
ironbee_console_url	IronBee Console hostname (no scheme) used to build session links in the report. Empty derives it from ironbee_collector_url, so a non-production collector does not produce production links.	no	""
ironbee_cli_version	IronBee CLI version to install (e.g. "1.0.0", "next", "latest").	no	latest
ironbee_project	Project the results attach to. Empty derives it from the git remote.	no	""
ironbee_environment	Environment the run is against — the deployment this workflow is verifying, by name (e.g. "staging", "production"). It selects the environment's own variables and secrets on top of the project-wide ones; a name the project has not seen is created by the first run that uses it, and leaving it empty resolves the project-wide ones alone. Empty falls back to the deployment environment when the event carries one (`deployment` / `deployment_status`). It cannot be derived otherwise: a job's own `environment:` key is not exposed to the job in any variable or context, so on a push or a pull request there is nothing to read and the workflow has to say which environment it is verifying.	no	""
ironbee_bind_repository	One of: true, false. Bind the run to the repository so the agent reads the changeset. Turn it off to verify the application without repository context — which is what a private repository the IronBee GitHub App does not cover needs.	no	true
ironbee_job_timeout_minutes	Run timeout for the verification job. Empty uses the API default.	no	""
ironbee_browser_devtools	One of: true, false. Web UI, DOM, console, a11y, screenshots, recording.	no	true
ironbee_backend_devtools	One of: true, false. HTTP, gRPC, GraphQL, WebSocket, DB, logs.	no	false
ironbee_node_devtools	One of: true, false. Node.js runtime — tracepoints, exceptions, variables, HTTP capture.	no	false
ironbee_python_devtools	One of: true, false. Python runtime (debugpy) — tracepoints, exceptions, logs, thread dumps.	no	false
ironbee_terminal_devtools	One of: true, false. CLI, REPL and TUI verification by driving a PTY. This gives the agent a shell on the runner — enable it only where that is the thing being verified.	no	false
ironbee_extra_config	Raw IronBee config as JSON. Deep-merged into the generated .ironbee/config.json; user keys win.	no	""
ironbee_exclude_files	One of: true, false. Keep IronBee-generated files (.ironbee/, .claude/, .mcp.json, .gitignore) out of the commits this action makes. On by default: they are this action's working files, not the change being verified, and a commit only happens when a verification fails and a fix is produced — so leaving them in adds machinery nobody wrote to a bug-fix diff, on runs nobody can predict. Turn it off to let a run commit the IronBee setup it generated.	no	true
anthropic_api_key	Anthropic API key. Required for local mode, and for fixing in platform mode.	no	—
claude_code_oauth_token	Claude Code OAuth token — the alternative to the API key.	no	—
claude_code_cli_version	Claude Code CLI version to install (e.g. "1.0.0", "latest").	no	latest
claude_code_model	Claude model for the agent that runs on this runner. Platform mode uses the platform default.	no	""
claude_code_max_turns	Maximum conversation turns for the agent that runs on this runner.	no	100
claude_code_args	Additional Claude Code CLI arguments.	no	""
verification_prompt	Additional instructions for the verification agent. Reaches whichever engine runs.	no	""
verification_auto	One of: true, false. Off means only a run somebody asked for by name — a comment command or a manual dispatch — verifies anything; a push or a pull request does nothing. It cannot save the workflow's own steps before this action (checkout, builds, installs); a job-level `if:` is what does that.	no	true
verification_command	The comment command that starts a run on an `issue_comment` event, as `<command> [--fix] [<prompt>]`. Only read on that event; the workflow decides who may use it.	no	/ironbee-verify
verification_apply_fix	One of: true, false. Apply fixes for the issues a failing verification reports. Needs an Anthropic credential; without one the run verifies and reports only.	no	true
app_install_command	Command to install application dependencies (e.g. "npm ci").	no	""
app_build_command	Command to build the application before verification (e.g. "npm run build").	no	""
app_start_command	Command to start the application (e.g. "npm run dev").	no	""
app_url	Application URL. A routable URL is verified as a deployment; a localhost one means the application runs on this runner and is reached through a reverse tunnel.	no	""
app_port	Local port the application listens on, for a tunnelled target. Required when app_start_command is set without an app_url, or when app_url points at localhost without a port. No default: a guessed port tunnels to nothing and fails deep inside the run, and a default here would also be indistinguishable from a port someone typed. The port in app_url wins when both name one.	no	""
app_restart_command	Command that restarts the application so it picks up the fixes, run between the fix round and the re-verification. Empty stops the process this action started and re-runs app_start_command, which is right only when that command runs the application itself: one that hands off — to docker compose, a process manager, a service — leaves the application running the pre-fix code, and the re-verification then reports a confident result about code that no longer exists. For a compose project whose services build from source, that command is "docker compose up -d --build".	no	""
app_logs_command	Command that prints the application's own logs, captured into the evidence artifact after the run. Needed whenever app_start_command hands off: what this action captures then is the lifecycle chatter of whatever it launched, not the application, so a service that died or stopped consuming leaves no trace and every question about it is answered by guesswork. For a compose project: "docker compose logs --no-color --tail=2000".	no	""
app_wait_seconds	How long to wait for the local application to accept connections. Empty uses the CLI default (60s).	no	""
app_headers	Request headers for a deployed URL, one "Name: value" per line. Non-secret values only.	no	""
app_secret_headers	Request headers whose values are secret — a deployment-protection bypass, an environment token. One "Name: value" per line, from a GitHub secret. Encrypted by the service and never read back.	no	""
github_token	GitHub token for PR operations.	no	${{ github.token }}
working_directory	Working directory for verification.	no	.
verbose	One of: true, false. Log each tool call the agent makes with its arguments, the tool responses, the prompt, the artifact list and verdict details. Off, the log carries what the agent says and how the run ended, which is what a reader wants; a tool call every second is progress, not information.	no	false

Outputs

name	description
verdict	Verification verdict (pass / fail / not_applicable / unknown)
mode	Where the verification ran (platform / local)
job_id	Verification job id — platform mode only; the last job when a fix was re-verified
job_url	IronBee Console link for the run — platform mode only, and only once the job claimed an attempt
artifacts_url	Download URL for verification evidence — local mode only; platform evidence lives in the Console