Use Canopy in CI

Canopy automatically detects CI environments and activates in ephemeral mode — no seat is reserved, and the activation is gone when the runner terminates.

You need one repository secret: CANOPY_LICENSE_KEY.

Ephemeral mode

When Canopy detects a CI environment (CI=true plus a vendor-specific variable), it skips machine fingerprint binding entirely. Your CI pipelines can run on any number of parallel runners without burning through seats. All ephemeral usage is logged in the admin portal for your records.

GitHub Actions

.github/workflows/forge-check.yml

name: Canopy health check

on:
  push:
    branches: [main]
  pull_request:

jobs:
  canopy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Canopy
        run: |
          curl -fsSL https://downloads.canopy.ironpinelabs.com/install.sh | sh
          echo "$HOME/.canopy/bin" >> "$GITHUB_PATH"

      - name: Activate license (ephemeral — no seat consumed)
        run: canopy activate "$CANOPY_LICENSE_KEY"
        env:
          CANOPY_LICENSE_KEY: ${{ secrets.CANOPY_LICENSE_KEY }}

      - name: Run health check
        run: canopy health --repo .

Canopy detects GITHUB_ACTIONS=true automatically. No extra configuration needed.

GitLab CI

.gitlab-ci.yml

forge-check:
  image: ubuntu:24.04
  variables:
    # CANOPY_LICENSE_KEY is a protected CI/CD variable set in Settings → CI/CD → Variables
    CANOPY_LICENSE_KEY: $CANOPY_LICENSE_KEY
  script:
    - curl -fsSL https://downloads.canopy.ironpinelabs.com/install.sh | sh
    - export PATH="$HOME/.canopy/bin:$PATH"
    - canopy activate "$CANOPY_LICENSE_KEY"
    - canopy health --repo .

CircleCI

.circleci/config.yml

version: 2.1
jobs:
  forge-check:
    docker:
      - image: cimg/base:2024.01
    steps:
      - checkout
      - run:
          name: Install and activate Canopy
          command: |
            curl -fsSL https://downloads.canopy.ironpinelabs.com/install.sh | sh
            echo 'export PATH="$HOME/.canopy/bin:$PATH"' >> "$BASH_ENV"
      - run:
          name: Run Canopy health check
          command: |
            canopy activate "$CANOPY_LICENSE_KEY"
            canopy health --repo .

Store CANOPY_LICENSE_KEY in CircleCI’s Project Settings → Environment Variables.

Buildkite

pipeline.yml

steps:
  - label: "Canopy health check"
    command:
      - curl -fsSL https://downloads.canopy.ironpinelabs.com/install.sh | sh
      - export PATH="$HOME/.canopy/bin:$PATH"
      - canopy activate "$$CANOPY_LICENSE_KEY"
      - canopy health --repo .
    env:
      CANOPY_LICENSE_KEY: # Set in Buildkite's environment hooks or Pipeline secrets

Overrides

Variable	Effect
CANOPY_EPHEMERAL=1	Force ephemeral mode (useful for testing)
CANOPY_EPHEMERAL=0	Force persistent mode even in CI (seat IS consumed)

Setting CANOPY_EPHEMERAL=0 is the escape hatch if you run a persistent long-lived CI agent that should own a dedicated seat.