Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 18 additions & 3 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

**Test the code examples in your documentation — automatically, in CI.**

The examples in a project's README are the first thing humans and AI assistants copy, and almost nobody tests them after writing them. The software changes, the examples don't, and they quietly break. readme-ci finds the code snippets in your Markdown documentation and (soon) executes them in a sealed sandbox, so "our examples always run" can be a CI-enforced promise instead of a hope.
The examples in a project's README are the first thing humans and AI assistants copy, and almost nobody tests them after writing them. The software changes, the examples don't, and they quietly break. readme-ci finds the code snippets in your Markdown documentation and executes the runnable ones in a sealed sandbox, so "our examples always run" can be a CI-enforced promise instead of a hope.

## Status

Expand All @@ -22,6 +22,15 @@ never falls back to running untrusted code on the host.

## Quick start

Install from PyPI:

```bash readme-ci:skip
pip install readme-ci
readme-ci scan README.md
```

Or from source, for development:

```bash
python3 -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
Expand Down Expand Up @@ -60,15 +69,21 @@ The marker never appears in the copyable code, and the snippet is reported as

## Safety design (the rule that governs this project)

Documentation snippets are untrusted input. When execution lands, it will be:
Documentation snippets are untrusted input. Execution is:

- **Sandboxed** — containers with networking disabled and strict timeouts
- **Conservative** — snippets containing destructive patterns (`rm`, `sudo`, pipe-to-shell, credential placeholders like `YOUR_API_KEY`) are classified as non-runnable and skipped
- **Opt-in** — nothing runs outside the sandbox, ever, and nothing runs at all unless you ask

## Why this exists

readme-ci is the first tool from [machine-operable](https://github.com/machine-operable), a research program measuring — and fixing — how reliably open source repositories work for the humans and AI agents that depend on them. Broken documentation examples don't just mislead newcomers anymore; they get learned and repeated by AI assistants at scale.
readme-ci is the first tool from [Machine-Operable Open Source](https://machine-operable.org/) ([GitHub](https://github.com/machine-operable)), a research program measuring — and fixing — how reliably open source repositories work for the humans and AI agents that depend on them. Broken documentation examples don't just mislead newcomers anymore; they get learned and repeated by AI assistants at scale.

## Feedback and background

- Found a snippet readme-ci misclassifies, or an example it runs wrongly? [Open an issue](https://github.com/machine-operable/readme-ci/issues). False positives are bugs.
- Overview of the work and related tools: [machine-operable documentation](https://oss-infrastructure-initiative.netlify.app/machine-operable-documentation) on the OSS Infrastructure Initiative site.
- How the research behind it is done: [method and evidence rules](https://ecogetaway.github.io/method.html).

## License

Expand Down
Loading