agentguard-action

A GitHub Action that runs GoPlus AgentGuard on changed files in a pull request (or the whole repository), fails the job at a configurable severity, and optionally comments on the PR with a summary.

Built for codebases where AI coding agents (Claude Code, Cline, Continue, Cursor, Aider, etc.) ship pull requests — and you want a scan to catch malicious or accidentally-risky agent-introduced changes before they merge.

Quick start

# .github/workflows/agentguard.yml
name: AgentGuard scan
on:
  pull_request:

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write   # for the PR-comment summary
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: theyavuzarslan/agentguard-action@v0
        with:
          level: balanced
          fail-on: critical

That's it. The action installs AgentGuard, scans the directories touched by the PR, and posts a one-table summary.

What it scans

When the trigger is pull_request, the action defaults to changed files only — it collapses the diff to unique containing directories and scans each. For other triggers (push, schedule, workflow_dispatch), it scans the whole repo. Override with scope: pr | all or list explicit paths.

What gets flagged

Whatever AgentGuard's 24 detection rules cover — shell exec, auto-update / download-execute, SSH key reads, system keychain reads, hardcoded private keys and mnemonics, wallet draining, unlimited approvals, selfdestruct, reentrancy, flash-loan risks, obfuscation, webhook exfil, and more. Severities map to safe | low | medium | high | critical.

Inputs

Name	Default	Description
paths	(unset)	Comma-separated paths to scan. Overrides scope.
scope	auto	pr (changed files) or all (whole repo). Auto-picks pr on pull_request events, all otherwise.
level	balanced	AgentGuard protection level: strict, balanced, permissive.
fail-on	critical	Minimum risk level that fails the job: critical, high, medium, low, never.
pr-comment	true	Post a sticky summary comment on the PR (requires pull-requests: write).
version	latest	npm version of @goplus/agentguard to install.
github-token	${{ github.token }}	Token used for the PR comment + diff lookup. Override only if you need broader scope.

Outputs

Name	Description
risk-level	Highest risk level across scanned paths.
risk-tags	Comma-separated unique risk tags.
paths-scanned	How many paths AgentGuard evaluated.
summary	One-line human summary.

Useful for chaining steps:

      - uses: theyavuzarslan/agentguard-action@v0
        id: scan
      - if: steps.scan.outputs.risk-level == 'high'
        run: echo "::warning::AgentGuard flagged high-risk content"

Permissions

The action needs pull-requests: write to post the PR comment and contents: read to read the diff. Without pull-requests: write the action still runs and still fails the job — it just skips the comment with a warning.

Local development

git clone <this repo>
npm install
npm run build      # bundles src/main.ts → dist/index.js via @vercel/ncc

The dist/ folder is committed because GitHub Actions runs the bundled JS directly. Don't edit dist/ by hand — re-run npm run build.

License

MIT