theanshsonkar/Carto Impact Report

Posts a structural impact report on every pull request: blast radius, cross-domain violations, affected routes, risk badge. Powered by carto-md.

Trust Signals

name	description	required	default
carto-version	The carto-md npm version to install. Use a pinned version (e.g. "2.0.9") in production for reproducibility. Default "latest" is fine for personal repos.	no	latest
base	Git ref the PR branched from. Defaults to GITHUB_BASE_REF on PR events; fall back to "origin/main" when the env var is missing.	no	""
head	Git ref of the PR head. Defaults to GITHUB_SHA.	no	""
fail-on	Exit non-zero when the rolled-up risk meets or exceeds this severity. One of: HIGH, MEDIUM, LOW. Empty (default) = the action never fails the build; the comment surfaces the risk and review handles it.	no	""
comment-mode	`sticky` (default) — find the previous carto comment by marker and update it in place, so a PR with N pushes still has exactly one Carto comment. `new` — post a new comment every time. `none` — render the report to stdout but don't post a comment (useful for forks where the GITHUB_TOKEN can't post comments).	no	sticky
node-version	Node.js version used to install + run carto-md.	no	20

name	description
risk	Rolled-up risk level: SAFE \| LOW \| MEDIUM \| HIGH. Lets downstream steps gate behavior on Carto's verdict (e.g. require approval on HIGH).
comment-url	URL of the posted PR comment (sticky or new). Empty when comment-mode=none or the post step was skipped (fork PRs without write access).