Audit repository quality in GitHub Actions. The default audit reads repository inputs and produces a fresh report. It does not execute repository commands.
Pin this Action by commit and install the public auditor with release-tag: v1.7.1.
Leave plan empty. Supervised execution is unavailable.
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
persist-credentials: false
- uses: neverhuman/jankurai-action@6cd9cbfdd503431ea33278a7444ff8f1772f3115
id: quality
with:
release-tag: v1.7.1
fail-under: '85'
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
if: always()
with:
name: jankurai-report
path: ${{ steps.quality.outputs.report-directory }}This example pins 6cd9cbf, the commit whose default release-tag is v1.7.1.
It also passes that tag explicitly. That commit rejects every nonempty plan.
Hosted CI on that commit
passed contract tests and real public v1.7.1 positive, stronger-policy, and
regression checks at floors 85 and 90.
| Input | Default | Meaning |
|---|---|---|
release-tag |
v1.7.1 |
Signed public auditor release from repo |
repo |
neverhuman/jankurai-audit |
Repository publishing the release. Tags up to v1.7.1 predate the hub rename and verify under the neverhuman/jankurai signing identity either way |
path |
. |
Repository to audit |
mode |
standard |
standard, advisory, ratchet, or release |
fail-under |
85 |
Additional score floor; use 90 for a stronger requirement |
baseline |
agent/baselines/main.repo-score.json |
Accepted baseline for ratchet/release modes |
plan |
empty | Reserved; all nonempty values are rejected |
The effective score requirement retains a stronger repository policy. Setting
fail-under: '0' removes only the additional Action floor. Hard findings, failed
scanners, unsuccessful auditor exits and ratchet failures still fail the step.
A passing ratchet flag must also agree with its score, caps, findings and policy;
the supported producer contract permits no score drop or policy change.
An advisory audit cannot hide a failed policy decision.
The report must describe the full repository, and its findings must agree with
the declared counts and passing decision. Missing or contradictory evidence
fails the Action.
Each invocation creates a private directory below RUNNER_TEMP. Outputs are
report-json, report-md, and report-directory. Upload the directory with
if: always() to retain reports from blocked audits. Failed admission may leave
the directory without a completed report; an older report is never substituted.
Supervised command execution is unavailable. Every nonempty plan value fails
clearly before the auditor is launched, on both supported platforms.
The bundled installer retains the producer's fixed signing, attestation, provenance, checksum and platform checks. Ordinary installation supports Linux x86-64 and Apple Silicon macOS. This repository does not publish auditor binaries. HTTPS downloads allow at most four attempts, with a 15-second connection timeout and a 60-second limit per attempt. Partial transfers are discarded before retry, and exhausted retries leave an existing installation unchanged. Verification failures stop installation without retrying or relaxing the trust checks.
Run bash scripts/ci-local.sh required to exercise the preserved score, policy,
freshness and installer contracts. It installs from the committed lockfile with
npm ci --ignore-scripts --no-audit --no-fund and then runs npm test.
The runner also accepts fast (tests against an existing install), security
(lockfile trust checks), audit (npm audit) and gates (all lanes); it
defaults to required and exits 2 on an unknown lane. Controlled
verifier/auditor fixtures are labeled in the tests.
This repository's own CI no longer runs on GitHub Actions. GitHub is a publishing mirror; CI runs on the forge and our own hosts, and releases are built and signed on our servers. A separate change introduces key-based release signing. The Action itself still runs in consumers' GitHub workflows.
Report vulnerabilities privately through the producer security advisories.