Code & secret checks
Run unit tests, lint, typechecking and a committed-secret scanner against the exact GitHub PR source.
Code Checks execute a published command against the exact source commit of a GitHub pull request. Reuse existing Node.js package scripts for unit tests, lint or typechecking. Add a separate secret scan when you want to check the committed source for credentials.
Use CLI 2.33.0 or newer with configuration version 4. SiteOS runs these checks on its hosted executor. They are PR-only: they do not run on a monitoring schedule or through remote pulse run.
Add a package-script check
Add this entry to checks in siteos.config.json, with the top-level version set to 4:
command is an argument array, not a shell string, starting with pnpm, npm or node. Choose a script that exists in your repository. A workingDirectory, when needed, is relative to the bound source directory. Keep unit tests, lint and typechecking as separate Checks when they need independent results.
Validate and test locally, then preview the bundle:
Remote runs use committed source, and with code Checks configured pulse validate checks the committed Git HEAD. Commit intended changes before validating. After review, publish with siteos pulse deploy --json. Bind the repository and enable its PR policy. Code-only configuration does not need Playwright or a website preview.
Supported execution environment
The hosted executor uses Node.js 22. The repository root must declare an exact npm 10 or pnpm 9/10 version in packageManager and include the corresponding committed lockfile.
Dependencies are installed from the public npm registry with a frozen lockfile and lifecycle hooks disabled; committed .npmrc and .pnpmfile.cjs settings are not applied. The command then runs without network access, Project variables or Secrets. Private registries, database services, custom runner images and tests that depend on those resources are not supported.
timeoutSeconds defaults to 300 and cannot exceed 600; it covers source preparation, dependency installation and the command. Executors are shared, so a code Check can wait for a free slot, and one Check never runs concurrently with itself. Relative symbolic links within the committed repository are supported. Absolute, escaping, cyclic or missing link targets and submodules cannot be prepared as a supported source snapshot; validation reports the affected path.
Local pulse test uses your local dependencies and environment. A local pass is useful, but it does not prove the same command succeeds inside the hosted executor.
Check for committed secrets
Add a separate Check using the built-in scanner:
The scanner inspects the selected committed source snapshot without installing dependencies or running package scripts. Reports include file, line, rule and a content SHA-256 while hiding credential values. It does not scan earlier Git history or establish that every possible security issue has been found. Revoke an exposed credential and remove it from source.
For a reviewed false positive, such as a public or synthetic value, add secretScanExceptions to that Check. Each entry names the exact file, rule and contentSha256 from the scan's safe diagnostic. Exceptions are published with the Check, stop matching when the content changes and cannot be added from PR configuration. Never exempt a real credential.
Use the same validate, local test, dry-run and publication workflow. Local secret checks scan committed Git HEAD and temporarily download the verified scanner on supported macOS or Linux hosts. The scanner has a fixed supported command; arbitrary scanner flags and repository ignore files do not silently change the hosted scan policy.
Read the result
A code run shows dependency installation and command execution with their saved output. These steps are not a count of individual unit tests. A preparation or executor error is distinct from a failing assertion or command.
Browser and code results have separate GitHub Checks. Passing lint cannot hide a pending preview check. Open the saved run for the exact head commit, inspect its output and confirm the next authorized PR attempt after a fix. See Evidence & alerts and execution usage.