Wire into CI
Fail builds on high blast radius, risky reviews, or dependency cycles.
Use exit codes and
--fail-onso structural risk fails the job, not the log.
prism index
prism review --base origin/main --fail-on high
prism cycles --fail-on any
prism blast src/critical/thing.ts --fail-on highExample GitHub Actions steps (full history for --base):
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: actions/setup-node@v4
with:
node-version: "26"
- run: npx -y @repo-prism/cli review --base origin/main --fail-on high
- run: npx -y @repo-prism/cli cycles --fail-on anyWhat you get back
| Exit | Meaning |
|---|---|
0 | Ran successfully |
1 | Ran successfully and found what you gated on |
2 | Usage error |
3 | Prism itself failed |
--fail-on takes a band (low / mid / high)
and fires at or above it. For counts (cycles), use any or a number.
stdout is data (and --json errors); progress goes to stderr.
When this is wrong
- Shallow clones (
--depth 1) starve git-derived signals. - Do not parse human tables in scripts — use
--json. - A gate that passes High while failing Moderate is almost never what you want; at-or-above semantics prevent that.