GitHub Action

GitHub Action

omit audit on every pull request: it measures the PR against its base branch and comments the verdict. It runs server-side, so it does not matter which agent, editor or human wrote the code.

Marketplace listing: omit audit.

Setup

# .github/workflows/omit.yml
on: pull_request
permissions: { contents: read, pull-requests: write }
jobs:
  omit:
    runs-on: ubuntu-latest
    # A fork's PR gets a read-only token, so the comment could only fail there.
    if: github.event.pull_request.head.repo.full_name == github.repository
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: sriinnu/omit@v0.6.0

Why each line is there:

• contents: read: naming any permission drops the rest to none. Without this, checkout fails on a private repo.
• pull-requests: write: the verdict is a PR comment.
• the if:: a pull request from a fork runs with a read-only token, so the comment step cannot succeed there. Skipping is honest; a red check that means nothing is not.
• a release tag, not @main: @main hands you whatever lands on main next.

Inputs

Input	Default	What it does
base	the PR's base branch (origin/<base>)	The single revision to measure the change against.
exec	false	Execute the run snippets in .omit/receipts.jsonl, and the repo's own linter.

exec is off for a reason: a PR's receipts and its lint config are untrusted code, and this runs on pull requests. Turn it on only for repos whose PRs you already run code from:

      - uses: sriinnu/omit@v0.6.0
        with: { exec: true }

Reading the verdict

### omit verdict
- net: +61 −204 lines across 4 files
- new deps: 0 ✅
- hazards: 0 ✅
- footnotes: 3 recorded · load-bearing: 1 marked
- receipts: 17/17 verified
- lint: eslint ✅

Row	What it is telling you
net	Lines added and removed, and how many files changed. Untracked files count. Binary files are scanned by content and noted, since git counts no lines for them.
new deps	Dependencies added to a manifest. (N without receipts ⚠) means some arrived with no verified receipt. 0 (N dependency-shaped files not parsed) means a file omit cannot read changed (setup.py, build.gradle, Package.swift, *.csproj), so zero is not a clean zero.
hazards	Hardcoded secrets and injection-prone lines, listed as type:rule, marked ⛔.
footnotes · load-bearing	How many // omitted: footnotes and load-bearing: markers the change carries.
receipts	Claims in .omit/receipts.jsonl that survived re-checking. FAILED ⛔ is a claim the tree refutes. unverifiable ⚠ is a claim that could not be settled: with exec: false, every receipt that needs its run snippet executed lands here.
lint	The repo's own linter, never omit's rules. not run with a reason is not a pass: with exec: false, CI does not run the linter at all. no linter configured means the repo has none.

Two more rows appear only when they apply: unparsed deps: names the dependency-shaped files omit did not parse, and hooks: reports a core.hooksPath that shadows the pre-commit gate.

It reports, it does not block

The Action comments a verdict. It does not fail the check when it finds a hazard or an uncited dependency. The thing that refuses is the pre-commit gate (npx @sriinnu/omit hook install), and the limits of that are in the README's What this does not catch.

Known limits

• One comment per push. Each run adds a new comment rather than editing the last one.
• Fork PRs get no verdict. Their token cannot comment. The if: above skips them.
• v0.4.1 and earlier count one file too many. The Action wrote its verdict into the checkout and then counted it as a changed file. Line counts were unaffected. Fixed in v0.5.0.