Skip to main content
coderifts Install on GitHub
GitHub Actions

CodeRifts GitHub Action

Only a granted change can proceed.

The two required contexts are CodeRifts / issuer and CodeRifts / contract-gate.

A pull request's real contract diff does not merge without a signed receipt, verified on the runner.

Format coverage, read 2026-10-04, is the table on the documentation page. An incomplete analysis in authorize mode is ANALYSIS_FAILED and STOP, with the gap named.

Suggested setup Setup

Suggested setup

The suggested setup: a pull request's real contract diff does not merge without a signed receipt, verified on the runner. Two contexts are required, CodeRifts / contract-gate and CodeRifts / issuer. One of them alone is not the gate.

The Action posts a check. Branch protection is what blocks the merge. On its own the check does not. A repository admin with enforce_admins: false can still merge past it. This gate is distinct from coderifts/action, which posts an advisory pull-request comment.

The wording above is the opening of the contract-gate README at commit 6d515a7, read on 2026-10-03.

The advisory action

Add a workflow file, set a secret, and you're done.

1

Get a free API key

Sign up at app.coderifts.com/api/signup to get your API key.

2

Add CODERIFTS_API_KEY as a repository secret

Go to Settings → Secrets and variables → Actions and add the key.

3

Add the workflow file

# .github/workflows/api-governance.yml
name: API Governance

on:
  pull_request:

jobs:
  coderifts:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: coderifts/action@v1
        with:
          api-key: ${{ secrets.CODERIFTS_API_KEY }}
          fail-on-breaking: true

Every pull request will now run a CodeRifts check and post results to the job summary.

This gate trusts the CodeRifts API response and fails the CI job. It does not verify a signed receipt, and it blocks a merge only if you make the job a required check.

GitHub App vs. GitHub Action

Choose the integration that fits your workflow.

GitHub App GitHub Action
SetupOne-click installWorkflow file + API key
PR CommentsAutomatic, inlineVia job summary
Zero ConfigYesRequires workflow file
Best ForTeams wanting zero setupTeams wanting full CI control

The two required contexts are CodeRifts / issuer and CodeRifts / contract-gate. GitHub App

One of them alone is not the gate. The Action posts a check. Branch protection is what blocks the merge. On its own the check does not.

The GitHub App and coderifts/action@v1 are advisory: they compute a verdict and surface it as a PR comment or job summary, failing the job when configured to. They trust the API response and do not verify a cryptographic receipt.

Only a granted change can proceed.

On its own the check does not.

Suggested setup The advisory action