conalh/PolicyMesh

Cross-surface AI agent policy consistency review.

Trust Signals

name	description	required	default
repo	Repository checkout path to inspect. Defaults to GITHUB_WORKSPACE.	no	""
fail-on	Severity that fails the action. Use none, low, medium, high, or critical.	no	none
github-token	Optional GITHUB_TOKEN with pull-requests:write. When provided on a pull_request event, PolicyMesh posts the Markdown report as a sticky PR comment that updates in place across pushes instead of appending a new comment each run. Leave unset to keep behavior unchanged.	no	""
recursive	When 'true', PolicyMesh walks the repo tree and audits every sub-project with its own agent config independently (monorepo mode). Findings keep their relative file paths so CI annotations land on the right line. Defaults to false to preserve existing single-project behaviour.	no	false
diff	When 'true' and the workflow is running on a pull_request event, PolicyMesh audits the PR base in a temporary worktree, audits HEAD, and emits PR annotations only for findings that are NEW or WORSENED in this PR. The step summary and sticky comment still show the full head report. The fail-on threshold gates on the delta rating, so a PR that does not introduce new conflicts can pass even when the repo has pre-existing findings. Requires the base ref to be fetchable; use fetch-depth: 0 on actions/checkout if your repo uses shallow clones.	no	false

name	description
rating	Highest PolicyMesh policy conflict rating.
finding-count	Total PolicyMesh findings in the audit.
surface-count	Number of configured agent policy surfaces found.