GitHub PR code verification: AI and churn checks on every pull request

What runs on each PR

The CodeDelta GitHub Action measures the pull request's diff — base to head, at logical-statement level — inside your own runner. Each PR gets:

• A sticky summary comment: statements added / deleted / edited in place, with generated-file churn counted separately, so a lockfile bump can't masquerade as work. Works on public and private repos alike.
• An Agent Scan: named AI-SDK and agent-framework calls introduced by the diff, and exec-on-model-output patterns — the constructs worth catching before merge.
• SARIF to the Security tab (GitHub code scanning), so findings live where your security review already looks.
• An optional merge gate: the job exits non-zero on new findings against a baseline, or on an AI-governance policy breach (model egress to unapproved destinations, model output reaching execution) — making the check required turns measurement into enforcement.
• An AI-BOM on request — the AI Bill of Materials for the changed tree, native or CycloneDX.

Setup

name: CodeDelta
on:
  pull_request:

permissions:
  contents: read
  pull-requests: write     # the summary comment
  security-events: write   # SARIF to the Security tab

jobs:
  codedelta:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: code-delta-app/action@v1
        with:
          license: ${{ secrets.CODEDELTA_LICENSE }}
          fail-on-new: "true"   # optional: block merges on new findings

That's the whole integration. The engine bundle downloads at run time; nothing about your code leaves the runner. Fork PRs are handled safely — the workflow runs on pull_request, so forks never see your secrets. During the free-trial period the license input can be omitted entirely.

Why in the PR, not in a dashboard

Measurement that lives outside the workflow gets looked at monthly and argued with never. A check on the pull request is read at the only moment it can change anything — before the merge — and its numbers are reproducible from the PR's own commit pair, which ends arguments instead of starting them. The measurement method is documented in open technical papers; the arithmetic re-runs from two hashes.

Set it up on one repository — first PR comment in about two minutes. GitLab, Jenkins and plain-CLI equivalents are on the CI page.