Add ai-surface CI demo walkthrough; clarify gate wording #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Drop this file at: .github/workflows/ai-surface.yml | |
| # | |
| # What it does: on every pull request, ai-surface maps the AI attack surface of | |
| # the repo and posts an inventory comment. The gate fails the PR when a high-severity | |
| # AI surface is present (fail-on: high). To accept a known baseline and fail only on | |
| # net-new findings, add a committed baseline via the CLI (see docs/CI_INTEGRATION.md). | |
| # This is a gate, not a one-time audit. | |
| name: AI Surface | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| pull-requests: write # required so the action can post / update the PR comment | |
| jobs: | |
| ai-surface: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # full history so the gate can diff against the PR base ref | |
| - uses: apisec-inc/AI-Surface@v1 | |
| with: | |
| comment-on-pr: 'true' # post / update the AI surface report on the PR | |
| fail-on: 'high' # fail the build when a high-severity AI surface is present |