Run stele in CI

The hooks catch most things while the agent works. CI catches the rest, whoever wrote the code.

GitHub Actions

Add this as .github/workflows/stele.yml:

name: stele
on: pull_request
permissions:
  contents: read
jobs:
  stele:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0 # stele needs the history to find what changed
      - uses: actions/setup-go@v6
        with:
          go-version: stable
      - run: go install github.com/lictor-ai/stele/cmd/stele@latest
      - run: stele check --base origin/${{ github.base_ref }}

Once stele has a stable release, pin that version instead of @latest.

What a failure looks like

$ stele check
main.go:6:2: error 573549ea-7f0b-47ec-ad30-db25284a3d2a "Log through the shared logger in internal/log. Never print w…": log through internal/log, not fmt.Print
main.go:7:10: error 2de7574e-7106-4986-8ce6-996d06e2703a "Never put credentials in code, config or tests. Read them fr…"
3 rules valid
checked 1 file: 2 errors

Each line gives the file, the position, the rule’s id, the start of the rule, and your message if it has one.

Run it yourself

Command	What it checks
stele check	Your uncommitted changes
stele check --base main	Everything changed since you branched from main
stele check --all	Every tracked file
stele check src/server.go	Just that file

Add --format json if another tool will read the result.

Why it might fail with no violations

stele check also makes sure your rules are in order. It fails if a rule is invalid, or if stele.lock or .claude/rules/stele-rules.md are out of date.

The fix is usually to run stele compile and commit the result.

Exit codes

Code	Meaning
0	All good
1	A rule was broken, or the rules need attention
2	stele couldn’t run, for example a wrong flag or no git