GitHub Actions

CodeRifts GitHub Action — API Governance in Your Workflow

Add coderifts/action@v1 to any GitHub Actions workflow and catch breaking API changes before they reach production. For teams who want full CI control without installing the GitHub App.

View on GitHub Setup Guide ↓

Setup in 3 Steps

Add a workflow file, set a secret, and you're done.

Get a free API key

Add `CODERIFTS_API_KEY` as a repository secret

Go to Settings → Secrets and variables → Actions and add the key.

Add the workflow file

# .github/workflows/api-governance.yml
name: API Governance

on:
  pull_request:

jobs:
  coderifts:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: coderifts/action@v1
        with:
          api-key: ${{ secrets.CODERIFTS_API_KEY }}
          fail-on-breaking: true

Every pull request will now run a CodeRifts check and post results to the job summary.

Advisory — this gate trusts the CodeRifts API response and fails the CI job. It does not verify a signed receipt, and it blocks a merge only if you make the job a required check. For a required-check merge gate with offline receipt verification — where administrators cannot bypass only if enforce_admins is set — use coderifts/contract-gate as a required status check — bound to the Action’s app, since the GitHub App posts an identically named advisory check.

GitHub App vs. GitHub Action

Choose the integration that fits your workflow.

	GitHub App	GitHub Action
Setup	One-click install	Workflow file + API key
PR Comments	Automatic, inline	Via job summary
Zero Config	Yes	Requires workflow file
Best For	Teams wanting zero setup	Teams wanting full CI control

Want zero-config PR comments? Install the GitHub App instead.

Advisory vs. enforcing

The GitHub App and coderifts/action@v1 are advisory: they compute a verdict and surface it as a PR comment or job summary, failing the job when configured to. They trust the API response and do not verify a cryptographic receipt.

coderifts/contract-gate (new · v0) is enforcing: it derives the change set from the pull request's real head diff, verifies a signed v4 receipt offline against a pinned keyring, and posts a status check named CodeRifts / contract-gate. Make that check required in branch protection, bound to this workflow’s app — not the GitHub App’s identically named advisory check — for a required-check merge gate, where administrators cannot bypass only if enforce_admins is set.

Start protecting your APIs with GitHub Actions.

Add the action, set your API key, and catch breaking changes on every pull request.

Get API Key — Free View Action on GitHub →