conalh/TaskBound

Post-session scope creep review for AI agent edits.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 23, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: conalh/taskbound@75d75fa79bf0472c93426b22c504aea533f33ccc # v0.7.2

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
task	Optional stated task or goal. Defaults to the pull request title and uses the pull request body as additional scope context.	no	""
scope-llm	Optional OpenAI or Anthropic model for LLM-assisted scope extraction. Falls back to heuristic scope when offline or unauthenticated.	no	""
repo	Repository checkout path to inspect. Defaults to GITHUB_WORKSPACE.	no	""
base	Base git ref or SHA to compare from. Defaults to the pull request base SHA when available.	no	""
head	Head git ref or SHA to compare to. Defaults to the pull request head SHA when available.	no	""
fail-on	Severity that fails the action. Use none, low, medium, high, or critical.	no	none
comment	Post or update a sticky pull-request comment with the TaskBound report. Requires pull-requests: write permission. Silently degrades to step summary + annotations on fork PRs where the GITHUB_TOKEN is read-only.	no	false

Outputs

name	description
rating	Highest TaskBound scope creep rating.
finding-count	Total TaskBound findings in the review.
changed-file-count	Number of changed files in the diff.
scope-match-count	Number of changed files that matched the inferred task scope.
sarif-file	Absolute path of the SARIF 2.1.0 report. Pipe into github/codeql-action/upload-sarif to land findings in Code Scanning.