Skip to content

Assay Action v2: Evidence Review in GitHub Actions

Marketplace
Marketplace

Choose a tag to compare

View all tags
@Rul1an Rul1an released this 28 Jan 09:24
v2
f0c2125
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Assay Action v2

Paste one workflow, get reviewable Assay evidence artifacts in GitHub Actions.

The action is intentionally small: it verifies checked-in or generated Assay evidence bundles, writes a compact job summary, uploads a named reports artifact, and can publish SARIF to GitHub code scanning.

What Fails A PR

By default, a PR fails only after review surfaces are written:

  1. bundle verification fails; or
  2. findings meet the configured fail_on threshold, defaulting to error.

That ordering is deliberate: install -> run/capture -> verify/lint -> upload artifacts -> fail. Reviewers should still have the evidence when a run is red.

Review Surfaces

  • Job summary for the fast human read.
  • assay-reports-${{ github.run_id }} for downloadable evidence review.
  • SARIF for GitHub code scanning when enabled.
  • Baseline finding delta for what changed versus the cached base-branch baseline.

Start Here

Use the copyable workflow in the README:

https://github.com/Rul1an/assay-action#readme

Related proof page:

https://github.com/Rul1an/assay/blob/main/docs/notes/EVIDENCE-RECEIPTS-IN-ACTION.md

Boundary

No dashboard. No hosted service. No model-correctness claim. No upstream integration claim.

The action makes the observed evidence boundary reviewable in a GitHub-native shape.

Capability Diff Preview

The Marketplace-visible README on main also includes an experimental, scripts-only capability diff preview. It is not part of the stable @v2 action interface, not a PR gate, and not a production mode: diff.

Preview feedback is tracked here:

#11

Assets 2
Loading