CodeRifts for GitHub — zero-config PR comments
Visit github.com/apps/coderifts and click Install. Choose which repositories to enable.
CodeRifts auto-detects .yaml, .yml, and .json files containing OpenAPI definitions. No config file needed.
CodeRifts posts a detailed report with every breaking change, risk score, policy violations, security analysis, and a suggested semver bump. See a real example: github.com/coderifts/demo/pull/4.
What the PR comment includes#
Every PR comment is a complete API governance report — not just a list of changes.
- Breaking changes — Every breaking change categorized by type and severity: endpoint removals, type changes, required field additions, and more.
- Risk score — A 0–100 score based on change severity, blast radius, and affected endpoints.
- Policy violations — Naming conventions, versioning rules, deprecation timelines — all configurable via
.coderifts.yml. - Security analysis — OWASP API Top 10 alignment, auth coverage analysis, sensitive field exposure detection.
- Semver recommendation — Suggests the correct version bump based on the changes detected.
- Auto changelog — Human-readable changelog entry, ready for release notes.
Minimal permissions#
CodeRifts requests only the permissions it needs. Your code stays private.
| Permission | Level | Why |
|---|---|---|
| Pull requests | Read & Write | To post PR comments with the analysis report |
| Contents | Read | To read OpenAPI spec files from the PR branch and base branch |
| Metadata | Read | Required by GitHub for all apps |
CodeRifts never stores your source code. Specs are analyzed in memory and discarded immediately. See Security & Trust.
Optional configuration#
CodeRifts works with zero config. For advanced use cases, add a .coderifts.yml to your repo root:
# .coderifts.yml — optional configuration
spec:
path: "api/openapi.yaml" # default: auto-detect
rules:
breaking-changes: error # error | warn | off
naming-convention: warn # camelCase enforcement
deprecation-policy: warn # require sunset headers
notifications:
slack:
webhook: $SLACK_WEBHOOK_URL
on: [breaking-change, security]See the full configuration reference for all available options.