janitor-security/Janitor Firewall
Zero-upload structural firewall for AI-generated PRs. Fails hard on any error — symmetric failure ensures the gate is never left pending. When a Governor URL is configured, the canonical PR verdict is the 'Janitor Integrity Check' run issued through the GitHub Checks API. When no Governor URL is configured, the workflow job itself is the gate.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 6, 2026
- License
- None
Pinned Snippet
uses: janitor-security/the-janitor@708495d08f83679dfd26156d0c51df489839766f # v10.2.11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| token | GitHub token (contents: read, pull-requests: read) | yes | — |
| deep_scan | Enable 32 MiB / 30 s deep-scan budgets for bounce analysis. | no | false |
| installation_id | Janitor Sentinel App installation ID for this repository. Auto-resolved from github.event.installation.id when omitted — only required if the workflow is triggered outside a GitHub App event context (e.g. workflow_dispatch or scheduled runs). | no | "" |
| governor_url | Base URL of your Sovereign Governor deployment. Optional: when omitted, the action runs a local-only bounce gate on the runner and fails the job on a rejected patch, but does not POST to a Governor. Provide a URL to publish the verdict through the Governor control plane. Example: https://governor.your-org.internal | no | "" |
| pr_number | PR number override. Set when invoking via workflow_dispatch to re-trigger the gate after a pull_request.opened event was dropped by GitHub Actions (Governor Janitor Integrity Check timed_out with no gate run recorded). When omitted, resolved from github.event.pull_request.number. | no | "" |
Outputs
no outputs