CI/CD

The impact agent belongs in a pull-request job that comments what it found, so reviewers see the blast radius of a change before they approve it.

Impact on pull requests

name: UIGraph Impact

on:
  pull_request:

permissions:
  contents: read
  pull-requests: write

jobs:
  impact:
    name: Report change impact
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Analyse impact
        env:
          AI_PROVIDER_MODEL: ${{ secrets.AI_PROVIDER_MODEL }}
          AI_PROVIDER_API_URL: ${{ secrets.AI_PROVIDER_API_URL }}
          AI_PROVIDER_API_KEY: ${{ secrets.AI_PROVIDER_API_KEY }}
          UIGRAPH_MCP_URL: ${{ secrets.UIGRAPH_MCP_URL }}
          UIGRAPH_API_URL: ${{ secrets.UIGRAPH_API_URL }}
          UIGRAPH_TOKEN: ${{ secrets.UIGRAPH_TOKEN }}
        run: |
          npx @uigraph/agents impact \
            --target "$(git merge-base origin/${{ github.base_ref }} HEAD)" \
            --report impact-report.md

      - uses: marocchino/sticky-pull-request-comment@v2
        with:
          path: impact-report.md

Three details matter here:

• fetch-depth: 0 — check out the full history, or the job cannot work out where the branch diverged.
• Both UIGraph URLs are required. UIGRAPH_MCP_URL is the graph the agent reasons over, UIGRAPH_API_URL is where the run is recorded, and one service-account token in UIGRAPH_TOKEN covers both. The job fails before it calls the model when any of them is missing.
• permissions: pull-requests: write — give the job permission to comment, or it cannot post what it found. The agent itself writes nothing, so read access to the code is enough.

On hosted UIGraph, drop both URLs and add --enterprise to the command instead:

          npx @uigraph/agents impact \
            --enterprise \
            --target "$(git merge-base origin/${{ github.base_ref }} HEAD)" \
            --report impact-report.md

Notes for CI

• Pin the version. npx @uigraph/agents@<version> keeps a model-driven job reproducible.
• Budget the runtime. This job calls a model repeatedly, so it is slower than a lint job. steps and shell.timeout in Configuration cap the worst case.
• Check the runner can reach UIGraph. A self-hosted UIGraph behind a VPN will not answer a hosted runner.

The report is only as good as the data in UIGraph, so pair this with a job that keeps artifacts current — see the artifacts agent's CI/CD page.