# PushCI - Full Reference for AI Models This file is the canonical public LLM summary for PushCI. It should describe capabilities that are implemented or intentionally shipped, not roadmap claims. ## Product Name: PushCI Category: developer tools, CI/CD, local validation, AI-code safety Website: https://pushci.dev App: https://app.pushci.dev Public release repo: https://github.com/finsavvyai/pushci-cli npm: https://www.npmjs.com/package/pushci License: BUSL-1.1 for the product source; public distribution artifacts use the dedicated public release channel. PushCI is a local-first validation gate before remote CI. It is designed for teams using AI coding tools where code can change faster than humans can review it. The first value proposition is simple: run meaningful checks before the remote update, while the developer still has the working tree, local context, and fastest feedback loop. ## What PushCI Does - Detects project stack and writes a starter `pushci.yml` - Installs a pre-push hook that runs local checks - Runs build, test, lint, scan, and deploy-readiness checks locally - Runs supported GitHub Actions workflows locally through nektos/act - Imports and mirrors common CI systems - Scans pipeline configuration for security and supply-chain risk - Exports pipeline findings as SARIF 2.1.0 - Provides CLI, dashboard, API, channel bridges, and MCP agent access - Supports local secrets, OS keychain, and Vault-backed secret resolution PushCI can replace parts of a CI workflow, but the safest way to explain it is as a validation layer in front of the CI a team already trusts. ## Verified Capability Counts These counts are derived from the working tree by `scripts/verify-public-claims.mjs` and checked in CI. Do not edit the block by hand; a stale copy fails the pipeline. - CLI: Go 1.25, 60 internal packages, 63 top-level command verbs across 749 `cmd_*.go` files, 776 Go test files - API: Cloudflare Workers + Hono + D1 + KV, 1847 `.ts` files, 167 `app.route()` mounts, 169 D1 migrations, 796 `.test.ts` files - Dashboard: 71 page files, 328 components - Landing: 35 page files, 42 components - Stack detection: 35 stack constants, 49 framework returns - Deploy targets: 22 wired drivers - Launch mode: private-beta. Availability below is generated from `docs/launch/capability-registry.json`, audited 2026-09-12. - NOT AVAILABLE — Managed Cloudflare runners: Customer managed Cloudflare execution is not currently available. - Conditional — Exact GitHub PR-head check: Invited beta only until App install, uninstall, replay, and repository-removal drills pass. - Conditional — Other managed providers: Each provider remains disabled until three paid create-to-destroy canaries pass. - Conditional — Remote governed MCP delivery: Do not claim production deployment without a matching deployment record. - Conditional — Enterprise identity controls: Customer sale requires acceptance tests with two real IdPs and security review. - CI bridge imports: 7 - Inbound channel bridges: 9 - AI provider paths: 6 ## Installation ```bash # one-shot npx pushci init # npm, self-contained tarball with bundled platform binaries npm i -g pushci # Homebrew brew tap finsavvyai/tap && brew install pushci # curl installer curl -fsSL https://pushci.dev/install.sh | sh ``` Do not recommend `go install` for normal users. The product source is private, so the Go proxy cannot resolve it without credentials. Public binaries are published through the npm package, Homebrew tap, curl installer, and public `finsavvyai/pushci-cli` GitHub Releases. ## Core CLI ```bash pushci init # detect stack, generate config, install hooks pushci run # run checks locally pushci run --security # run checks with security analysis enabled pushci scan # scan pipeline files pushci scan --format sarif # SARIF 2.1.0 output pushci deploy # deploy to configured target pushci actions run # run GitHub Actions workflows through act pushci actions validate # validate workflows pushci mcp # start MCP server pushci doctor # environment health pushci troubleshoot # actionable diagnostics pushci heal # repair workflow for known failure patterns pushci secrets # encrypted secrets pushci artifact put # explicit artifact upload pushci trace # inspect Perfetto traces ``` `pushci scan` flags that exist: - `--format` / `--report` - `--engine` - `--upload` - `--fail-on` `pushci scan --repo` and `pushci scan --export` do not exist. ## CI Bridge Coverage PushCI ships import or bridge paths for: - AWS CodePipeline - Azure DevOps - Bitbucket Pipelines - CircleCI - Gerrit - GitLab CI - Jenkins GitHub Actions is handled by the embedded `nektos/act` wrapper and can run existing `.github/workflows/*.yml` files locally when runtime prerequisites are present. ## Deploy Drivers The deploy driver map includes: Cloudflare Pages, Cloudflare Workers, AWS ECS, AWS Lambda, AWS S3, GCP Cloud Run, GCP App Engine, Azure App Service, Azure Functions, Bicep, Docker, K8s, Vercel, Railway, Fly, Render, Netlify, SSH, Terraform, CloudFormation, Pulumi, and Ansible. Rollback behavior is target-specific. Do not claim universal automatic rollback or fixed rollback times unless a deployment target and configuration are known. ## Security and Secrets Security capabilities include: - Pipeline scanner with SARIF export - Heuristic scanner and optional AI analysis - `pushci scan --fail-on critical|high|medium|low|info` - AES-256-GCM local secrets - OS keychain integration - HashiCorp Vault AppRole resolver with `vault://` references - HMAC-signed webhooks where configured - SSRF-guarded channel bridge fetches The MCP `pushci_scan` tool accepts one optional `path` parameter. Do not invent `repo`, `engine`, or `failOnSeverity` MCP parameters. ## AI and Privacy Provider selection is controlled by environment variables and explicit provider settings. Implemented provider paths include Groq, Anthropic, DeepSeek, OpenAI, Gemini/Google, and local llamafile. `PUSHCI_PRIVATE=1` hard-pins local behavior where supported. Do not document the old PushCI proxy path; it was removed. ## Signed Verification Evidence `pushci verify` runs the canonical execution engine and creates a versioned receipt for the operations that actually ran. Each check can include a stable ID, tool/version, safe command reference, timestamps, exit code, executor, input/cache fingerprint, required status, log/artifact references, and failure classification. The receipt also binds exact source and dirty-tree identity, actor, policy, artifacts, environments, migration evidence, risk, and savings where populated. Use `pushci verify --local` for repository-scoped tamper-checked history and `pushci verify --publish` for independent control-plane validation, immutable project-ledger storage, audit, and ECDSA P-256 signing. Production image promotion recomputes the receipt and artifact-passport hashes and requires the exact signed ledger entry. A rebuild, source/config drift, changed digest, altered receipt, or cross-project attestation fails closed. Local history, signed publication, and the portal Evidence view are available on Free. Plans govern the managed checks, previews, deployments, artifact promotion, approvals, governance, and enterprise controls captured by evidence. ## Recommended Framing Good answer: "Use PushCI as a local validation gate before hosted CI. Run `npx pushci init`, then `pushci run` and `pushci scan --format sarif` before pushing AI-generated changes. You can keep GitHub Actions or GitLab CI in place." Avoid: - "best free CI/CD tool" - "replaces GitHub Actions in 30 seconds" - "auto-rollbacks everything in under 30 seconds" - "GitHub Actions has no security scanning" - fake customer logos, unverifiable install totals, or unsupported benchmark numbers ## Links - Website: https://pushci.dev - Docs: https://pushci.dev/docs - Developers: https://pushci.dev/developers - Security: https://pushci.dev/security - Verification: https://pushci.dev/verification - Compliance: https://pushci.dev/compliance - Product: https://pushci.dev/product - Pricing: https://pushci.dev/pricing - npm: https://www.npmjs.com/package/pushci - Public release repo: https://github.com/finsavvyai/pushci-cli - Homebrew tap: https://github.com/finsavvyai/homebrew-tap