CLI 0.7.5：下载并解压发行包即可运行下列示例，只需 Node.js 24。无需源码工程和 MoonBit。

# Same rules in local review and CI

All files are synthetic. The example permits at most 5 delete records per file, denies attribute clear and rename, and limits the file to 100 change records. These values are demonstrations, not production recommendations.

From the extracted CLI directory (or a built source checkout):

```text
node dist/moonldif.js review examples/profiles/within.ldif --profile examples/profiles/rules.json --all --format json
node dist/moonldif.js review examples/profiles/exceeded.ldif --profile examples/profiles/rules.json --all --format markdown
node dist/moonldif.js review examples/profiles/incomplete.ldif --profile examples/profiles/rules.json --all --format json
```

Expected exit codes: 0, 1, 2 respectively. The incomplete file retains the known exceeded limit. Load rules.json in the workbench and run the same fixtures; search/filter does not change the overall result. Increase the delete limit to 6, recheck, and download the edited configuration for CLI reuse.

`node examples/profiles/check-ci.mjs report.json examples/profiles/rules.json examples/profiles/exceeded.ldif` saves a new report and exits 1. Report files include DNs; review your own artifact retention and access before uploading real reports.

The following workflow steps assume the CLI ZIP has been downloaded, checksum-verified and extracted, with Node.js 24 available. See the complete download example in ../ci/README.md; no MoonBit installation is needed. Use explicit file paths:

```yaml
- name: Check maintenance plan
  run: node examples/profiles/check-ci.mjs report.json examples/profiles/rules.json examples/profiles/within.ldif
- name: Keep the diagnostic report
  if: always()
  uses: actions/upload-artifact@v7.0.1
  with:
    name: ldif-check
    path: report.json
```

Do not set continue-on-error on the check. An uploaded report does not convert an intercepted or incomplete plan into success. Each file's limits are independent; splitting a plan does not provide aggregate protection. No LDAP connection or operation is performed.