mick-gsk/Drift — AI Code Coherence Monitor
Catches what CodeQL and Semgrep don't cover: pattern fragmentation, architecture erosion, mutant duplicates, temporal volatility. Deterministic quality control layer for AI-assisted Python development.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- MIT
Pinned Snippet
uses: mick-gsk/drift@b9b1aec174e737ee31cbad40d368c4ad1add3076 # v2.51.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| repo | Path to the repository root to analyse. | no | . |
| fail-on | Exit 1 if any finding is at or above this severity: critical | high | medium | low | none. Use 'none' for report-only. | no | none |
| since | Days of git history to consider for temporal signals. | no | 90 |
| format | Terminal output format: rich | json | sarif | no | rich |
| config | Path to a drift.yaml config file (optional). | no | "" |
| upload-sarif | Upload SARIF results to GitHub Code Scanning so findings appear as inline annotations on pull requests. Requires the 'security-events: write' permission. | no | false |
| drift-version | pip install spec for drift-analyzer, e.g. 'drift-analyzer==0.2.0'. Defaults to the latest published release. | no | drift-analyzer |
| comment | Post a PR summary comment with drift score, severity distribution, and top findings. Only works in pull_request events. Requires the 'pull-requests: write' permission. | no | false |
| brief | Run drift brief and post a pre-task structural briefing as a PR comment. Extracts scope from the PR title or the brief-task input. Only works in pull_request events. Requires the 'pull-requests: write' permission. | no | false |
| brief-task | Task description for drift brief. If omitted, the PR title is used. | no | "" |
| create-issue | Paket 2C / ADR-095 — when 'true', automatically open a GitHub issue in the CURRENT repository for every BLOCK-severity drift finding (finding severity = critical or high). Opt-in: default is 'false' to respect the 'no unsolicited posting' contract. Requires the 'issues: write' permission on the calling workflow. Deduplicates against existing open issues by embedding the drift finding_id in the issue body so that re-runs do not spam the tracker. | no | false |
| issue-labels | Comma-separated labels applied to auto-filed drift issues. Ignored unless 'create-issue' is 'true'. Labels MUST already exist in the repository; the workflow does not create labels. | no | drift,agent-block |
Outputs
| name | description |
|---|---|
| sarif-file | Absolute path to the generated SARIF file (only set when upload-sarif is 'true'). |
| drift-score | The drift score (0.00–1.00) from the analysis. |
| finding-count | Total number of findings. |
| severity | Overall severity level. |
| grade | Letter grade (A–F) derived from the drift score. |
| badge-svg | Absolute path to the generated SVG badge file. |