GitHub Action

Static checks and baseline comparison inside CI. No cloud signup required.

Add it to a workflow

Use the repository and release tag listed in the release report. The public distribution repository is mAIb-Tech-LLC/driftseal. Pin a verified commit for stronger provenance.

name: DriftSeal
on: [pull_request, push]
jobs:
  driftseal:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: mAIb-Tech-LLC/driftseal@v1
        id: driftseal
        with:
          path: ./agent-tools
          baseline: .driftseal-baseline.json
          fail-on: critical
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: driftseal-evidence
          path: ${{ runner.temp }}/driftseal-results/

Approve a baseline

Create a baseline locally and commit it after review. If the baseline file exists, the Action compares against it. If absent, it reports static indicators from a one-time scan. Baseline target identities must match.

Results and permissions

The Action writes a job summary, report.json, result.json and result.sarif. It sets result and sarif outputs. Upload SARIF with GitHub's supported code-scanning upload action when the repository supports it and grants security-events: write. Uploading artifacts with if: always() preserves results when severity gating fails.

The Action does not post PR comments or request write access by default. It does not install the target project. Untrusted pull requests must not receive cloud tokens. Do not use pull_request_target to execute unreviewed PR code.