moonrunnerkc/Swarm Audit, the merge gate for AI-generated PRs

Audits PRs opened by AI coding agents for cheat patterns (test relaxation, mock-of-hallucination, assertion strip, no-op fix). Posts findings as a PR comment and gates merges on blocking results. Also runs the legacy v8 orchestrator pipeline when invoked with goal/contract-path.

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Stale
License
None
namedescriptionrequireddefault
audit-modeSet to true to run `swarm audit` against a PR diff. When true, the action operates as a merge gate: exit 0 = pass, exit 1 = blocking findings. Pairs with `pr` (default: ${{ github.event.pull_request.number }}). nofalse
prPR reference for audit mode. owner/repo#NN, a GitHub PR URL, or just the PR number (the action infers owner/repo from GITHUB_REPOSITORY). no
diff-filePath to a unified diff on disk (alternative to `pr`). Used by audit mode when a diff is already materialized. no
emit-aibomEmit an AI-BOM artifact alongside the audit. Values: cyclonedx-ml | spdx-ai | both. Output written to .swarm/aibom/. no
audit-commentWhen true (the default in audit mode), the action posts the rendered Markdown comment to the PR using GITHUB_TOKEN. notrue
goalNatural-language goal. Compiled into a contract and executed unless contract-only is true. Mutually exclusive with contract-path. no
contract-pathPath to an already-compiled contract directory (skips compile). Use this when you compile contracts in a prior step and want to run them verbatim. Mutually exclusive with goal. no
contract-onlyWhen true, compile the goal into a contract and stop without executing it. The contract directory under .swarm/contracts/ is the artifact. Requires goal (cannot be combined with contract-path). nofalse
contract-filePath to a YAML or JSON contract file. Consumed by the deterministic extractor; pairs with goal to produce a compiled contract without an LLM round-trip. no
contract-modulePath to a TS/JS module whose default export is a contract object. Deterministic extractor only. no
extractorExtractor provider: deterministic | local | anthropic.no
sessionSession provider: deterministic | local | anthropic.no
modelModel id override (anthropic provider). API keys are NEVER passed as inputs, set ANTHROPIC_API_KEY through the workflow `env:` block. no
local-backendLocal backend: openai-compatible | ollama | llama-cpp | vllm.no
local-base-urlBase URL for the local provider.no
local-model-extractorLocal-provider model id for the extractor (compile pass).no
local-model-sessionLocal-provider model id for the session (run pass).no
local-grammarGrammar mode: auto | gbnf | json-schema | outlines | none.no
external-patches-queuePath to a JSONL queue of patch envelopes (deterministic session).no
external-patches-dirPath to a watched dir of patch envelopes (deterministic session).no
falsifierson (default) | off, disables falsifier adapter calls when off.no
modeExecution mode: single (default) | tournament.no
candidatesTournament candidates per round (1-8). Ignored in single mode.no
max-obligationsCap on the number of obligations attempted per run.no
cost-capLive output-token ceiling; aborts streams once projected output crosses it.no
repo-rootProject root for repo-context discovery (default: GITHUB_WORKSPACE).no
working-directoryDirectory to cd into before running. Default: GITHUB_WORKSPACE.no
result-pathWhere the structured run-result JSON is written. Default: /tmp/swarm-result.json. The entrypoint always reads this path back into the `result` step output. no
extra-argsAdditional raw CLI flags appended verbatim to the swarm invocation, whitespace-separated (shell-style quoting respected). Use this only for flags not exposed above (e.g. `--snapshot-cleanup always`, `--forbid-import lodash`, `--falsifier-scheduler ucb1`). no
namedescription
resultJSON summary of the run (obligations satisfied, tokens, wall time).
audit-passAudit mode: "true" when no blocking findings, "false" when blocking.
audit-findingsAudit mode: count of blocking findings.
audit-ledgerAudit mode: path to the JSONL evidence ledger written by the run.