CodeRifts for GitHub
Only a granted change can proceed.
A pull request's real contract diff does not merge without a signed receipt, verified on the runner.
The two required contexts are CodeRifts / issuer and CodeRifts / contract-gate.
The App alone does not block a merge until branch protection requires the check.
Install on GitHub — free during betaInstall in 3 Steps
Click "Install" on the GitHub Marketplace
Visit github.com/apps/coderifts and click Install. Choose which repositories to enable.
Open a pull request that modifies an OpenAPI spec
CodeRifts auto-detects .yaml, .yml, and .json files containing OpenAPI definitions. No config file needed.
Require both contexts
The two required contexts are CodeRifts / issuer and CodeRifts / contract-gate. The App alone does not block a merge until branch protection requires the check. Suggested setup
What the PR comment also carries
Every PR comment carries the API governance report — not just a list of changes.
Breaking Changes
Every breaking change categorized by type and severity — endpoint removals, type changes, required field additions, and more.
Risk Score
A 0–100 score based on change severity and the endpoints the change reaches. It is a heuristic for reviewers, not a calibrated probability — and it does not count your consumers, which we do not observe.
Policy Violations
Naming conventions and versioning rules, configurable via .coderifts.yml.
Security Analysis
Auth-scheme changes, sensitive-field exposure and PII findings on the same verdict. We do not claim OWASP API Top 10 coverage — the one OWASP taxonomy CodeRifts cites is the OWASP MCP Taxonomy, and it is cited by the MCP tool-description classifier, not by an API scanner.
Semver Recommendation
Suggests the correct version bump (patch, minor, major) based on the changes detected.
Auto Changelog
A human-readable changelog entry generated from the diff — ready for release notes.
App permissions
Read on 2026-10-03 from GET https://api.github.com/apps/coderifts, HTTP 200, app id 2860592, updated 2026-09-25, the permission set is checks write, contents read, deployments read, issues read, metadata read, and pull_requests write. No other permission is in that record.
That same record lists the events deployment, deployment_status, issues, issue_comment, pull_request, pull_request_review, and push.
| Permission | Level | Why |
|---|---|---|
| pull_requests | write | Pull-request comment |
| contents | read | Repository file access |
| checks | write | The check run |
| issues | read | Slash command in a pull-request thread |
| deployments | read | Deployment status |
| metadata | read | Required by GitHub for every App |
Configured specification files (Core Diff) from the base and head of a pull request. If none are configured, discovery reads OpenAPI-named files instead. When files are configured, the same discovery may also read OpenAPI-named files that are not in the list, to notice them. Opt-in MigraGuard reads migration files and application source references when a pull request changes a migration file. Opt-in ActionGuard reads workflow YAML when a pull request changes a workflow file. Those file reads are in memory and the file content is not persisted. Trust center. Security policy
Optional Configuration
One-click install. Enforcement is a branch-protection setting. For a narrower artifact list, add a .coderifts.yml to your repo root.
With no config, the App discovers specs by four glob patterns — **/openapi*.yaml, **/openapi*.json, **/swagger*.yaml and **/swagger*.json. A spec that matches none of them is not found, and the check reports neutral rather than failing — name the path yourself if yours sits elsewhere.
CodeRifts does not honour skip markers: [skip coderifts] in a title, body, label or commit message is refused and the required check decides the change as usual.
# .coderifts.yml — optional configuration
# Keys below were run through the App's own parser on 2026-09-15.
# ⚠ A key the parser does not know is accepted silently and then ignored,
# so a typo looks exactly like a working config. Spell these exactly.
schema:
- "api/openapi.yaml" # default: auto-detect by glob
fail_on_breaking: true # fail the check on any breaking change
policy:
no_delete_endpoints: true
max_breaking_changes: 0
notify:
slack_webhook: $SLACK_WEBHOOK_URLSee the full configuration reference for all available options.
Start protecting your APIs in 30 seconds.
No credit card required. See pricing for what the tiers include.
During the public beta every organization gets Team features at $0 with a self-serve key, public and private repositories alike, no separate Team key to request, and each key allows 1,000 requests a month: after that, /preflight authorize returns BETA_LIMIT_REACHED while its analysis keeps working; other API routes return 429.