CodeRifts GitHub Action — API governance in your workflow
Sign up at app.coderifts.com/api/signup to get your API key.
Go to Settings → Secrets and variables → Actions and add the key.
# .github/workflows/api-governance.yml
name: API Governance
on: pull_request
jobs:
coderifts:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: coderifts/action@v1
with:
api-key: ${{ secrets.CODERIFTS_API_KEY }}
fail-on-breaking: trueEvery pull request will now run a CodeRifts check and post results to the job summary.
Advisory — this gate trusts the CodeRifts API response and fails the CI job. It does not verify a signed receipt, and it blocks a merge only if you make the job a required check. For an unbypassable, cryptographically verified gate, use coderifts/contract-gate as a required status check.
GitHub App vs. GitHub Action#
| GitHub App | GitHub Action | |
|---|---|---|
| Setup | One-click install | Workflow file + API key |
| PR Comments | Automatic, inline | Via job summary |
| Zero Config | Yes | Requires workflow file |
| Best For | Teams wanting zero setup | Teams wanting full CI control |
Want zero-config PR comments? Install the GitHub App instead.
Advisory vs. enforcing#
The GitHub App and coderifts/action@v1 are advisory: they compute a verdict and surface it as a PR comment or job summary, failing the job when configured to. They trust the API response and do not verify a cryptographic receipt.
coderifts/contract-gate (v0) is enforcing: it derives the change set from the pull request's real head diff, verifies a signed v4 receipt offline against a pinned keyring, and posts a status check named CodeRifts / contract-gate. Make that check required in branch protection for an unbypassable gate.