Problem
The GitHub Action uploads artifacts and SARIF, but the signal reviewers act on — "this PR added an unauthenticated route" / "coverage class changed on 3 routes" — is buried in artifacts or the code-scanning tab. A sticky PR comment with the drift/coverage summary puts authorization changes in front of reviewers where approval decisions happen, which is the tool's core review loop.
Current behavior
action.yml supports scan, baseline compare, artifact upload, and SARIF upload; there is no PR comment output. The Markdown renderer already produces exactly the right content (drift summary, coverage counts, per-route sections) via authmap diff / scan Markdown output.
Proposed implementation
- New action inputs
pr-comment (default false), pr-comment-mode (drift — only when drift/gating findings exist — or always), optional github-token input defaulting to ${{ github.token }}.
- Sticky comment upsert
- Composite-action step (bash +
gh api, consistent with the existing action style — no new Rust code): render/reuse the Markdown summary, wrap with a hidden marker (<!-- authmap-summary -->), then find-and-update the existing marked comment or create one (standard sticky-comment pattern). Truncate to GitHub's comment size limit with a link to the full artifact when the summary is large.
- Skip gracefully (with a log line, not a failure) when not in a
pull_request context or when the token lacks permission.
- Docs
docs/GITHUB_ACTION.md: document the inputs, the required pull-requests: write permission block, a full workflow example combining baseline + diff + comment, and the privacy note that route paths from the repo are posted to the PR thread (consistent with docs/DATA_HANDLING.md posture — content stays within the repo's own PR).
Acceptance criteria
References
action.yml (existing inputs/steps)docs/GITHUB_ACTION.md, docs/DATA_HANDLING.md- Markdown drift summary:
authmap diff output (crates/authmap-report)
Problem
The GitHub Action uploads artifacts and SARIF, but the signal reviewers act on — "this PR added an unauthenticated route" / "coverage class changed on 3 routes" — is buried in artifacts or the code-scanning tab. A sticky PR comment with the drift/coverage summary puts authorization changes in front of reviewers where approval decisions happen, which is the tool's core review loop.
Current behavior
action.ymlsupports scan, baseline compare, artifact upload, and SARIF upload; there is no PR comment output. The Markdown renderer already produces exactly the right content (drift summary, coverage counts, per-route sections) viaauthmap diff/ scan Markdown output.Proposed implementation
pr-comment(defaultfalse),pr-comment-mode(drift— only when drift/gating findings exist — oralways), optionalgithub-tokeninput defaulting to${{ github.token }}.gh api, consistent with the existing action style — no new Rust code): render/reuse the Markdown summary, wrap with a hidden marker (<!-- authmap-summary -->), then find-and-update the existing marked comment or create one (standard sticky-comment pattern). Truncate to GitHub's comment size limit with a link to the full artifact when the summary is large.pull_requestcontext or when the token lacks permission.docs/GITHUB_ACTION.md: document the inputs, the requiredpull-requests: writepermission block, a full workflow example combining baseline + diff + comment, and the privacy note that route paths from the repo are posted to the PR thread (consistent withdocs/DATA_HANDLING.mdposture — content stays within the repo's own PR).Acceptance criteria
pr-comment: trueon a PR with drift, exactly one comment appears and is updated in place on subsequent pushes (no comment spam).driftmode posts nothing on a clean PR;alwaysmode posts the summary regardless.docs/GITHUB_ACTION.mdupdated; CHANGELOG entry.References
action.yml(existing inputs/steps)docs/GITHUB_ACTION.md,docs/DATA_HANDLING.mdauthmap diffoutput (crates/authmap-report)