ryan-mt/tomte — Done Means Verified
Verify a PR with evidence, not claims: run the project's own test/typecheck/lint/build via `tomte prove` (real exit codes), optionally require a bound Commit Seal on HEAD (`tomte seal verify`), and walk the repo's decision trail and risk map (`tomte rounds`). Fails when red; posts the evidence as a step summary and an optional PR comment.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| version | tomte release to install — a tag like `v0.0.4`, or `latest`. | no | latest |
| prove | Run `tomte prove` (the proof capsule; fails the job on a red check). | no | true |
| seal-verify | Run `tomte seal verify` — require HEAD to carry a verified Commit Seal. Off by default: a PR's merge ref is rarely the sealed commit. | no | false |
| rounds | Run `tomte rounds` (drift watch, risk risers, hot-and-untested files; fails the job on red). Runs with `--no-proof` when `prove` already ran the checks, so the suite isn't paid for twice. | no | true |
| comment | Post the evidence as one self-updating comment on the pull request (needs `pull-requests: write` permission on the job). | no | false |
| github-token | Token used to post the PR comment. | no | ${{ github.token }} |
| working-directory | Directory to verify (defaults to the workspace root). | no | . |
Outputs
| name | description |
|---|---|
| verified | "true" when every selected gate passed, else "false". |