hiro-o918/rinkaku PR report
Runs rinkaku against a pull request's diff and posts (or updates) a sticky PR comment: a mermaid call/dependency graph up front, with a slim "API changes" digest (added/signature-changed/removed symbols only — ADR 0036) collapsed underneath. Falls back to $GITHUB_STEP_SUMMARY when posting a comment isn't possible (fork PRs get a read-only token from `pull_request`; see the `comment`/`github-token` inputs below), and to a Markdown-only report when the resolved rinkaku binary predates `--format mermaid`/ `--format digest`.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| version | rinkaku release tag to download from GitHub Releases, e.g. "v0.4.1". Defaults to the latest release. Ignored when `binary` is set. | no | latest |
| binary | Path to an already-built rinkaku binary to use instead of downloading a release asset. Set this when the caller already built rinkaku itself (e.g. the dogfooding workflow in this repository, which builds rinkaku from the PR's base ref rather than trusting a release binary built from who-knows-where) — leaving `version`'s download step skipped entirely rather than duplicating the compose/post logic in two places. | no | "" |
| repo-path | Path to the git checkout rinkaku should analyze (i.e. the one `--base`'s `git diff`/`git show` resolve against). Defaults to the current directory, which is only correct when this action's own steps run inside that checkout — the dogfooding workflow in this repository instead points this at a separate PR-head checkout, since the checkout this action itself is invoked *from* must stay the trusted base copy (see that workflow's top-of-file comment for the full trust-boundary rationale: both the rinkaku binary AND the orchestration code executing it must come from base, never from the PR head). | no | . |
| base | Base ref to diff against, passed through to `rinkaku --base`. Defaults to the pull request's base ref. | no | ${{ github.event.pull_request.base.ref }} |
| github-token | Token used to read/write the PR comment via `gh`/`gh api`. On a fork PR, the token `pull_request` events receive is read-only regardless of the workflow's `permissions:` block — see `comment` below for how this action degrades when posting fails. | no | ${{ github.token }} |
| comment | Whether to post/update a sticky PR comment. When `false`, this action only produces the report files referenced by this action's outputs — useful for callers that want to compose their own comment or use the report some other way. Also downgrades automatically (rather than failing the job) when posting isn't possible at all: a fork PR's `pull_request` token is read-only regardless of this input or the workflow's `permissions:` block, so `compose_and_post_comment.sh` treats a 403 from the comment-post API call as "write to $GITHUB_STEP_SUMMARY instead" and still exits 0. | no | true |
Outputs
| name | description |
|---|---|
| mermaid-path | Path to the generated mermaid report file. Empty when the resolved rinkaku binary doesn't support `--format mermaid` (see `markdown-only` below). |
| digest-path | Path to the generated "API changes" digest file (ADR 0036). Empty when the resolved rinkaku binary doesn't support `--format digest` (see `markdown-only` below). |
| markdown-path | Path to the generated Markdown report file. |
| markdown-only | "true" when the resolved rinkaku binary predates `--format mermaid` and/or `--format digest` and this run fell back to a Markdown-only report. |