GitHub Change Risk

A GitHub Action that returns deterministic risk signals for a public compare range without executing repository code or requiring an API token. It is designed as a quick review aid, not a security audit.

Create .github/workflows/change-risk.yml with this complete workflow to add the free report to every pull request:

name: Change risk

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read

jobs:
  change-risk:
    runs-on: ubuntu-latest
    steps:
      - uses: orangevakaris/github-change-risk@v1
        id: change-risk
        with:
          repository: ${{ github.repository }}
          base: ${{ github.event.pull_request.base.sha }}
          head: ${{ github.event.pull_request.head.sha }}

The Action writes risk-score, risk-level, a compact JSON report, and a prefilled checkout-url to its outputs. Free runs also include that checkout link and the live per-file-report payment requirements in the workflow summary; paid runs do not repeat those links.

Pull request comment

Set comment: true to post the free aggregate report directly on a pull request. The workflow must grant pull-requests: write permission and pass its built-in token and pull request number:

permissions:
  contents: read
  pull-requests: write

- uses: orangevakaris/github-change-risk@v1
  with:
    repository: ${{ github.repository }}
    base: ${{ github.event.pull_request.base.sha }}
    head: ${{ github.event.pull_request.head.sha }}
    comment: true
    github-token: ${{ github.token }}
    pull-request-number: ${{ github.event.pull_request.number }}

Commenting is opt-in. The action fails rather than posting if the token or pull request number is missing.

Risk gate

Set fail-on to make the workflow fail at the selected deterministic risk level. The default is never, so existing workflows remain report-only.

- uses: orangevakaris/github-change-risk@v1
  with:
    repository: ${{ github.repository }}
    base: ${{ github.event.pull_request.base.sha }}
    head: ${{ github.event.pull_request.head.sha }}
    fail-on: high

Per-file report

The default report is free. To request the per-file report, send at least 0.01 native USDC or 0.00001 native ETH on Base to 0x5157E1783c81DA37DAa8Bb490c68b30aB0e9D3A7, wait for confirmation, then provide its transaction hash:

- uses: orangevakaris/github-change-risk@v1
  with:
    repository: owner/repository
    base: main
    head: feature-branch
    payment-tx: ${{ secrets.BASE_PAYMENT_TX }}

This Action only supports public repositories. The API service is at https://76.13.79.47.sslip.io and its OpenAPI contract is available at https://76.13.79.47.sslip.io/openapi.json.

Inputs

Input	Required	Description
repository	Yes	Public repository in owner/repository form.
base	Yes	Base commit SHA or ref.
head	Yes	Head commit SHA or ref.
fail-on	No	Fail at low, medium, or high; defaults to never.
payment-tx	No	Confirmed Base USDC or ETH payment transaction for a per-file report.
api-url	No	API base URL, useful for testing.
comment	No	Set to true to post the aggregate report on a pull request.
github-token	Only when commenting	Built-in GitHub token with pull-requests: write.
pull-request-number	Only when commenting	Pull request to receive the aggregate report.

License

MIT. See LICENSE.