open-delivery-spec/Open Delivery Spec
AI code quality gate — detect AI code, analyze quality, score tech debt, enforce policy
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 7, 2026
- License
- Apache 2.0
Pinned Snippet
uses: open-delivery-spec/validate-action@6d33d66f6077400ae163b4759f32b823f895e12c # v0.2.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| diff-base | Git ref to diff against (e.g., origin/main, HEAD~3) | no | origin/main |
| pr-body | PR description body text (auto-detected from event if omitted) | no | — |
| pr-body-file | Path to file containing PR description body | no | — |
| branch | Branch name (auto-detected from git if omitted) | no | — |
| commits | Maximum number of commits to scan for AI markers | no | 10 |
| policy | Path to OPA Rego policy file | no | .ods/policy.rego |
| sarif | Path to a SARIF v2.1.0 file from an external analyzer (Semgrep, CodeQL, golangci-lint, ESLint, ...) to merge into the analysis, score, and policy gate. These findings are authoritative and multi-language; ODS built-in heuristics are only hints. | no | "" |
| semgrep | Run Semgrep automatically and merge its findings (zero-setup multi-language analysis). Ignored when `sarif` is set — bring-your-own SARIF wins. | no | false |
| semgrep-config | Semgrep ruleset used when `semgrep: true`. Defaults to the curated `auto` registry config; can be a registry ID (e.g. p/ci) or a local rules file. | no | auto |
| ai-review | Newline- or comma-separated paths to AI reviewer verdict files (review-verdict/v1 JSON) to feed into the policy gate as input.ai_reviews. Advisory by default: a request_changes verdict routes extra human review, it never denies unless your policy opts in. Requires a CLI with `ods check --ai-review` (v0.7.1+; the pinned default satisfies this); older CLIs skip the input with a warning. | no | "" |
| report | Append an AI attribution digest (AI vs human commit/line share over a window) to the job summary, PR comment, and artifact. Needs full git history (checkout with fetch-depth: 0). | no | false |
| report-since | History window for the attribution digest (any git --since expression). | no | 90 days ago |
| summary | Append Markdown report to the GitHub Actions job summary | no | true |
| comment | Create or update an ODS report comment on pull requests | no | true |
| review-routing | Act on the policy's review_tier verdict: label the PR (ods:review/auto|standard|elevated) and, for elevated, request the reviewers listed in elevated-reviewers. Requires a policy that defines review_tier and a CLI version that reports it. Routing is advisory and never fails the run. | no | false |
| elevated-reviewers | Comma-separated GitHub usernames to request as reviewers when the review tier is "elevated" (used only with review-routing: true). | no | "" |
| artifact | Upload the generated ODS report directory as a workflow artifact | no | true |
| output-dir | Directory where ODS report files are written | no | ods-report |
| artifact-name | Workflow artifact name for the generated ODS report | no | ods-report |
| artifact-retention-days | Number of days to retain the uploaded ODS report artifact | no | 30 |
| github-token | GitHub token used for PR comments | no | ${{ github.token }} |
| cli-ref | ODS CLI version, tag, or commit to install. Defaults to a pinned stable release for reproducible runs; set to `main` to track the latest. | no | v0.7.2 |
Outputs
| name | description |
|---|---|
| result | pass | warn | block |
| ai-detected | Whether AI code was detected |
| ai-confidence | AI detection confidence (0.0–1.0) |
| tech-debt-delta | Technical debt delta score |
| policy-allowed | Whether the OPA policy allowed the change |
| review-tier | Policy review-routing verdict: auto | standard | elevated |