The Audit in CI
Tonight's claim: a Python script calls the Figma REST API and flags three problems: any layer still named Frame, Rectangle or Group; any filled colour that matches a published variable but is coded as raw hex; and any text node under sixteen pixels. A non-zero exit code fails the CI job.
The Audit in CI
Tonight's claim: a Python script calls the Figma REST API and flags three problems: any layer still named Frame, Rectangle or Group; any filled colour that matches a published variable but is coded as raw hex; and any text node under sixteen pixels. A non-zero exit code fails the CI job.
Series: Figma for Educational AI Topic: FIGMA · CI · AUDIT
Chapters
0:00 Introduction 0:26 Introduction 1:32 Your Turn
YOUR TURN
Your turn. Paste this into Claude: Here's my audit dot p y script, then paste it. My Figma file key is, then paste it. Add a fourth check: any component instance that is detached from the library. Write the test that catches it, add it to the script, and update the Action so CI runs on pull requests as well as pushes. Then check two things yourself
@NikBearBrown
Part of the Figma for Educational AI series.
Sources and citations: see the reel's SOURCES.md in the open textbook.
▶ The full series playlist — Brutalist https://www.youtube.com/playlist?list=PLG9H-C6rp5RU
What this video covers
- 0:00 — Introduction
- 0:26 — Introduction
- 1:32 — Your Turn
Transcript
A lightly formatted transcript of the video, with timestamps so you can jump to any section on YouTube.
Introduction
[0:00] Terra, this is Liam in for Bear. Can a push trigger a design check? Better, can a script catch those problems before the first review? Three terms, the Figma REST API, a web endpoint that returns a design file as structured data, one get request per file, one token. A GitHub action, a script that runs on every push to your repository. And a personal access token, a credential Bear sets once as a repository secret, only he can create it. Tonight's claim, a Python script
Introduction
[0:27] Calls the Figma REST API and flags three problems. Any layer still named frame, rectangle, or group. Any filled color that matches a published variable but is coded as raw hex. And any text node under 16 pixels. A non-zero exit code fails the CI job. The script has three probes. It walks every layer deeply, not just the top, and collects three lists. Unnamed, any node whose base name is a Figma default. Raw hex, any fill color that matches a variable value but was not bound to it. And small text, any text node with a font size below 16 pixels. Print the findings, exit one if any list is non-empty. The GitHub action is eight lines. On every push to main, check out the repository, install requests, and run the script with the file key and the token. The token is a repository secret that Bear adds once in GitHub settings. It is not in this repository. The action only reads. Figma token is not set tonight. The script exited one with a usage line. No audit ran on FEA8 agent draft. The verdict is pending. The token as a repository secret and the first CI run that reads the real file.
Your Turn
[1:32] Your turn, paste this into Claude. Here's my audit.py script, then paste it. My Figma file key is, then paste it. Add a fourth check, any component instance that is detached from the library. Write the test that catches it, add it to the script, and update the action so CI runs on pull requests as well as pushes. Then check two things yourself. Run the script locally on a file you know has unnamed layers. Does it exit one? And add the token to a repository secret. Does the CI job run on your next push? The audit in CI at Nick Bear Brown.
