Loopt compiles GitHub Actions workflows written in TypeScript, Python, Go or Rust to YAML

A compiler for CI pipelines

Loopt, an open-source project published under the preloopdev organization on GitHub and featured on Hacker News's front page, treats GitHub Actions as a compilation target rather than an authoring format. Developers write workflows in TypeScript, Python, Go or Rust — all four ship as first-party languages — and the tool generates conventional YAML files under .github/workflows/. Additional languages can be added through a plugin protocol.

Because the output is ordinary GitHub Actions YAML, nothing changes from GitHub's perspective when a repository adopts the tool. Generated files carry a header comment stating they were produced by Loopt and directing edits to the source files under .loopt/workflows/ instead.

Working with existing workflows

Adoption usually starts with pipelines that already exist, and Loopt addresses this with loopt import, which converts current workflow YAML into editable source code while leaving the original files untouched. Composite actions defined in action.yml files outside .github/workflows/ import as action metadata in the same way.

Sync discipline runs in both directions. loopt gen regenerates the YAML from source and refuses to overwrite a workflow that was edited by hand outside Loopt unless --force is passed. Running loopt gen --check fails whenever the committed YAML no longer matches the committed source, which turns format drift into something a CI job can catch automatically.

Scaffolding and secure defaults

loopt init writes a starter workflow in the chosen language, generates the corresponding YAML and adapts to the project it finds. According to the project's README, a detected package.json produces npm install and test steps, Cargo.toml yields cargo test, go.mod yields go test ./..., and Python packaging files lead to pip and pytest steps. Repositories with none of these markers get a placeholder step to replace.

The defaults are notably security-conscious. Every starter uses a read-only token scoped to contents: read, pins actions/checkout to a specific commit, avoids persisting credentials, cancels superseded runs and passes the tool's own lint checks. The README stresses that the starter is only a beginning point to be edited freely.

Linting and supporting commands

loopt review runs native correctness and security checks over generated workflows, optionally passing run: scripts through shellcheck. loopt gen invokes the same review automatically, so the checks execute on every generation rather than as a separate opt-in step. The review supports flags such as --persona, --context and --shellcheck, with a documented severity mapping.

Around the core compile step sits a set of supporting commands: loopt actions produces typed, commit-pinned action imports; loopt secrets sync maintains a names-only inventory of secrets; and loopt lock enforces pinning of uses: references through a workflow lockfile. Authoring SDKs are published on npm as @preloopdev/sdk and on crates.io as loopt-sdk.

Availability

Prebuilt binaries cover macOS on arm64 and Linux on x86_64, installed via a shell script that verifies the release checksum when one is published. Environment variables can redirect the install directory or pin a specific release such as v0.1.1. The runtime for whichever language you author in — Node.js 26 or newer, Python 3, Go, or Cargo/Rust — must be installed at generation time. The project is MIT-licensed.

Why it matters

CI YAML is notoriously error-prone: it has no types, relies on string-interpolated expressions and encourages copy-paste between jobs. Authoring workflows in a general-purpose language brings type checking, abstraction and testing tooling to pipeline code, and the compile-to-YAML design means there is no platform lock-in — the emitted files are plain GitHub Actions that keep working even if Loopt disappears from the picture. The drift check and the refusal to silently clobber hand-edited workflows answer the main practical objection to generated files, namely that two representations of the same pipeline will inevitably diverge. And baking least-privilege tokens and commit-pinned actions into the default starter nudges secure CI configuration from a documented best practice into the path of least resistance.