How-to
Gate a deploy on Kno in CI
Run Kno as a CI check and branch on its exit codes, completed, budget stopped, or interrupted, without treating a cap as a failure.
Kno’s exit codes are a contract designed for CI.
The pattern
kno baseline --evals cases.jsonl --agent openai:gpt-4.1 \
--max-cost-usd 2.00 --yesBranch on the code:
| Exit | Meaning | CI action |
|---|---|---|
0 |
Completed | Continue |
1 |
Failed | Fail the build, something is broken |
2 |
Stopped at budget cap | Not a failure |
3 |
Validation failed | Fail the build (reserved for kno validate) |
4 |
Interrupted | Not a failure, resume it |
Do not map 2 and 4 to failure: reporting them as 1 trains people to
ignore 1, which is the code that actually means something is wrong.
Secrets in CI
Keys come from the environment only. In CI that means the secret store of
your CI system, exported as OPENAI_API_KEY / ANTHROPIC_API_KEY ,
never into kno.yaml, never into the repo.
Full recipe: Gate a deploy on Kno in CI.