Setting up · page 5 of 13
Bring a project you already have
Most projects arrive this way. Nothing about how you build changes; Constat learns to read what your CI already does.
What Constat needs from your repository
Three things, and it will tell you which you already have.
- A test run that produces a machine-readable report — one entry per check, with its full name and whether it passed.
- A workflow that publishes that report under the names Constat looks for, along with the same report from the code as it was before the change, and the coverage.
- A key for your agents, as a repository secret. Constat records its name and never its value.
The full shape is in What your CI must publish.
Step 1 — point Constat at the repository
On the project door, choose an app that exists and give the repository's address.
Step 2 — install the witness
Constat asks you to install its app on that repository. It reads your code and never writes it. The screen prints what it may do and what it may not, before the button:
It may read contents, read Actions runs and artifacts, start and cancel runs of your own workflows, read checks, read pull requests and their files, read secret names.
It may not read a secret's value, write a file, push a commit, merge, or reach a repository you did not install it on.
You choose which repositories it sees. You can remove it from GitHub at any time.
Step 3 — read the readiness page
Constat now reads the repository and says one of:
- Ready — its CI already publishes everything. Skip to step 5.
- Missing — it names each piece in plain words.
- A dead end — Constat has no reporter for that language yet, and says so rather than letting you find out after an attempt.
Step 4 — run one line
Where something is missing, the page prints the exact line for your project:
npx @constat-io/cli connect owner/repo
It runs on your computer, signed in to GitHub as you. It writes the files to a branch and opens a pull request in your name — Constat's own credential cannot write to your repository, which is what keeps what it reads evidence rather than something it arranged.
Read the pull request. Merge it when you are happy. Constat notices the merge the next time it looks, and the readiness page turns green on its own.
Everything the tool would write is also printed on the page, file by file, if you would rather add them by hand.
The tool never asks for a secret's value. It prints the name and where to put it, and that is all it knows.
Step 5 — add the secret
The name is on the page. Put it in the repository's Actions secrets.
Step 6 — decide where attempts run
By default they run on GitHub's machines. If you have a runner of your own, give its label on the project's settings and the runner will stand there instead, asking Constat for work every thirty seconds — no button to press.
What has changed in your repository
A workflow that asks Constat for work and runs your agent. A workflow that publishes what your CI already ran. Nothing that changes how your software is built, tested or deployed.