AgentDiff CI is the GitHub App behind the agentdiff-ci[bot] identity.
Install it on any repo that runs the AgentDiff gate, and your team gets a
zero-configuration, fully branded re-baselining experience — no secrets, no
variables, no per-repo setup.

What it does

• Branded approvals — reviewers comment /agentdiff approve on a flagged
  PR, and the bot re-records the golden baseline, commits it, and comments as
  agentdiff-ci[bot] (with AgentDiff's logo) instead of the anonymous
  github-actions[bot].
• Genuine green checks — commits pushed with the App's token re-trigger
  CI, so the bot posts a real, green AgentDiff Check result on the new
  head via the Checks API after every approval.
• Zero-config identity — the approve workflow mints a short-lived
  installation token from AgentDiff's hosted identity service
  (token.agentdiff.app). Nothing to store, rotate, or leak.

Security model

• Stateless by design — the token service stores nothing: no logs, no KV,
  no databases.
• Least privilege — the caller must already present a GitHub Actions token
  with access to the repo it claims, and the App must be installed there.
• Bounded tokens — minted installation tokens expire in ≤ 1 hour, always.

What it requests

Install AgentDiff CI · Docs · Source