cboyd0319/HarnessForge

Create, assess, and safely update AI coding-agent repo harnesses.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 26, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: cboyd0319/harnessforge@cc2b48e15cb64256fd8df0defab9d7d04601c9a9 # no releases — HEAD as of 2026-07-11

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
command	Command to run: audit, init, update, sync, verify, report, release-check, finalize-review, migrate-state, or doctor.	no	audit
target	Repository path to inspect or modify.	no	.
python-version	Python version for the action runtime.	no	3.13.14
min-score	Minimum acceptable audit score from 0 to 100.	no	85
fail-on-score	Fail when the audit score is below min-score.	no	true
apply	Apply safe missing-file corrections for update, review finalization for finalize-review, or state migration for migrate-state.	no	false
force	Allow overwriting generated files during init or update.	no	false
enhance-existing	Append reviewed HarnessForge guidance to existing instruction files during init or update.	no	false
agent-file	Root agent instruction file name to generate.	no	AGENTS.md
platform-contract	Generated harness platform contract.	no	cross-platform
with-ci-workflow	Also scaffold the optional manual HarnessForge CI workflow for init or update.	no	false
generation-max-files	Maximum number of repository files to scan during command init or applied command update.	no	4000
generation-component-limit	Maximum number of detected components to include during command init or applied command update.	no	80
verify-run	Execute verification checks when command is verify. Default verify mode is read-only plan mode.	no	false
verify-command	Optional newline-separated repo-owned verification commands for command verify.	no	""
verify-timeout-seconds	Per-command timeout in seconds when command is verify and verify-run is true.	no	300
verify-summary	Optional target-relative compact verify evidence JSON path for command verify.	no	""
require-verify-evidence	Require current passed stored verify evidence when command is sync or report.	no	false
sync-command	Optional newline-separated repo-owned readiness commands for command sync.	no	""
report-command	Optional newline-separated repo-owned readiness commands for command report, release-check, or finalize-review.	no	""
report-max-files	Maximum number of repository files to include in command report index summary.	no	4000
report-component-limit	Maximum number of detected components to include in command report or release-check index summary.	no	80
report-since	Optional git ref for command report docs fan-out analysis.	no	""
require-docs-fanout-budget	Fail command report when docs fan-out exceeds the configured budget or duplicate durable fact blocks are present.	no	false
require-sbom	Fail command release-check when no existing SPDX or CycloneDX SBOM is detected.	no	false
accept-detected-high-risk	Record accepted advisory evidence for detected high-risk surfaces when command is finalize-review.	no	false
reviewed-by	Optional newline-separated reviewer names for command finalize-review.	no	""
evidence-ref	Optional newline-separated evidence references for command finalize-review.	no	""
html-report	Optional target-relative path for an HTML audit report.	no	""
json-report	Optional target-relative path for an audit, sync, verify, report, release-check, finalize-review, or migrate-state JSON report.	no	""
markdown-report	Optional target-relative path for a Markdown report when command is report or release-check.	no	""

Outputs

name	description
overall-score	Harness audit score from 0 to 100.
bottleneck	Lowest-scoring harness domain.
report-json	JSON report path when requested.
report-html	HTML report path when requested.
report-markdown	Markdown report path when requested.
changed-files	Number of files written by init, update, finalize-review, or migrate-state.
verify-verdict	Verify verdict when command is verify.
verify-summary	Compact verify evidence JSON path when requested.
readiness-verdict	Readiness verdict when command is sync.
sync-exit-code	Sync readiness exit code when command is sync.
docs-fanout-verdict	Docs fan-out verdict when command is report or release-check.
release-verdict	Release-check verdict when command is release-check.