mizcausevic-dev/Evidence Bundle Diff
PR gate for evidence-bundle manifest changes — diffs HEAD vs base, posts a comment, fails on breaking changes.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 11, 2026
- License
- AGPL 3.0
Pinned Snippet
uses: mizcausevic-dev/evidence-bundle-diff-action@8613a8120ae9572fb91da1b1443e647f51b258f5 # v1.0-prodtags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| manifest-path | Path (relative to repo root) to the evidence-bundle manifest JSON file being changed in the PR. | yes | — |
| base-sha | Override the base SHA used to retrieve the previous version. Defaults to pull_request.base.sha from the event payload. | no | — |
| comment-on-pr | Post the Markdown diff as a PR comment. 'auto' (default) posts only on pull_request events; 'true' / 'false' force the behavior. | no | auto |
| fail-on-breaking | Fail the run when the diff is classified as BREAKING (default 'true'). | no | true |
| fail-on-any-change | Fail the run when there is ANY diff at all (default 'false'). Useful for frozen-bundle workflows. | no | false |
| github-token | Token used to post the PR comment (defaults to GITHUB_TOKEN). | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| breaking | True iff the diff is BREAKING. |
| change-count | Number of changes detected in the diff. |
| new-manifest | True iff the manifest path didn't exist at base SHA (newly added manifest). |