v0.9.0
← All docs

GitHub Action

omit wiki at ac68124 · checked against v0.9.0Updated for v0.9.0: the fail-on and gate inputs, the pinned example and the one-comment-per-pull-request line.

omit audit on every pull request: it measures the PR against its base branch and comments the verdict. It runs server-side, so it does not matter which agent, editor or human wrote the code.

Marketplace listing: omit audit.

Setup

# .github/workflows/omit.yml
on: pull_request
permissions: { contents: read, pull-requests: write }
jobs:
  omit:
    runs-on: ubuntu-latest
    # A fork's PR gets a read-only token, so the comment could only fail there.
    if: github.event.pull_request.head.repo.full_name == github.repository
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: sriinnu/omit@v0.9.0

Why each line is there:

Inputs

Input Default What it does
base the PR's base branch (origin/<base>) The single revision to measure the change against.
exec false Execute the run snippets in .omit/receipts.jsonl, and the repo's own linter.
fail-on none Fail the check when the verdict carries hazards: secret for hardcoded secrets, hazard for any hazard (secrets, injection, TLS). The verdict is commented first either way.
gate false Also run omit gate --range over every commit in the PR and fail the check on a block. Adoption and mode are read from the PR's base, so a PR cannot loosen its own gate. Runs omit from the Action's own checkout with execution off, needs fetch-depth: 0 and a pull_request event, not pull_request_target.

exec is off for a reason: a PR's receipts and its lint config are untrusted code, and this runs on pull requests. Turn it on only for repos whose PRs you already run code from:

      - uses: sriinnu/omit@v0.9.0
        with: { exec: true }

Reading the verdict

### omit verdict
- net: +61 −204 lines across 4 files
- new deps: 0 ✅
- hazards: 0 ✅
- footnotes: 3 recorded · load-bearing: 1 marked
- receipts: 17/17 verified
- lint: eslint ✅
Row What it is telling you
net Lines added and removed, and how many files changed. Untracked files count. Binary files are scanned by content and noted, since git counts no lines for them.
new deps Dependencies added to a manifest. (N without receipts ⚠) means some arrived with no verified receipt. 0 (N dependency-shaped files not parsed) means a file omit cannot read changed (setup.py, build.gradle, Package.swift, *.csproj), so zero is not a clean zero.
hazards Hardcoded secrets and injection-prone lines, listed as type:rule, marked ⛔.
footnotes · load-bearing How many // omitted: footnotes and load-bearing: markers the change carries.
receipts Claims in .omit/receipts.jsonl that survived re-checking. FAILED ⛔ is a claim the tree refutes. unverifiable ⚠ is a claim that could not be settled: with exec: false, every receipt that needs its run snippet executed lands here.
lint The repo's own linter, never omit's rules. not run with a reason is not a pass: with exec: false, CI does not run the linter at all. no linter configured means the repo has none.

Two more rows appear only when they apply: unparsed deps: names the dependency-shaped files omit did not parse, and hooks: reports a core.hooksPath that shadows the pre-commit gate.

It reports unless you ask it to block

By default the Action comments a verdict and the check stays green, even when it finds a hazard or an uncited dependency. Set fail-on or gate to make it refuse. The check that refuses on every commit, whatever the CI setting, is the pre-commit gate (npx @sriinnu/omit hook install), and the limits of that are in the README's What this does not catch.

Known limits

Read the wiki page on GitHub