QuickstartProof

Free repository-native check

Read two files. Execute nothing.

The JavaScript Action selects exactly one local Markdown/MDX quickstart and one local OpenAPI JSON/YAML document after checkout. Exact paths remain the default; version 1.1 can discover either omitted path only after explicit opt-in. It makes no network call, reads no repository secret, writes a bounded result to GitHub outputs, the job summary, and RUNNER_TEMP, and emits escaped warnings for located high-confidence mismatches plus a concise state line to the job log.

Publishing status: the public repository, v1.1.0 release, and GitHub Marketplace listing are live. Publication is a distribution receipt, not evidence of installs, customers, or revenue.

Install workflow

name: quickstart proof
on:
  pull_request:
    paths:
      - "docs/quickstart.md"
      - "openapi/openapi.yaml"

permissions:
  contents: read

jobs:
  proof:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b163ceea73d27597364c9af683
      - uses: jacobw26/quickstartproof-action@v1
        with:
          quickstart-path: docs/quickstart.md
          openapi-path: openapi/openapi.yaml
          fail-on-changes: "false"

The floating v1 tag currently points to the reviewed v1.1.0 release commit 27680ab91b5886d16cbf3af0c49516adc96ae8d5. For an immutable dependency reference, review that commit and use jacobw26/quickstartproof-action@27680ab91b5886d16cbf3af0c49516adc96ae8d5.

Optional bounded discovery

Callers may omit either configured path, or both, only by setting discover-paths: "true". Discovery accepts exactly one quickstart or getting-started Markdown/MDX file and exactly one openapi or swagger JSON/YAML file. It never follows symlinks, skips dependency and build trees, and fails closed on missing or multiple candidates, excessive depth, more than 10,000 traversed entries, more than 5,000 regular files, or an oversized selected file. Supplying both exact paths bypasses discovery.

- uses: jacobw26/quickstartproof-action@v1
  with:
    discover-paths: "true"
    fail-on-changes: "false"

Three possible states

  • aligned-on-static-checks — no bounded mismatch or unresolved ambiguity was found. This is not a certification.
  • changes-found — at least one high-confidence static mismatch is tied to a quickstart source line.
  • insufficient-public-input — dynamic shell, unsupported YAML, external references, excessive scope, or another ambiguity prevents a reliable conclusion.

Hard security boundary

  • No cURL, shell block, SDK, repository script, lifecycle hook, container, or customer code is executed.
  • No token, secret, password, credential, or API-key input exists.
  • No telemetry or outbound request is made after checkout.
  • Repository-relative paths reject traversal, encoded traversal, absolute paths, unsupported types, and symlinks escaping the checkout; discovered paths reject symlink components entirely.
  • OpenAPI references must stay internal. Bounded parsing returns UNKNOWN on unsupported syntax.
  • UNKNOWN evidence remains in the summary and never becomes a warning; repository-controlled warning fields are workflow-command escaped.
  • The action never edits repository contents or opens a pull request.

Machine output

state, a bounded result-json, and a result-file inside RUNNER_TEMP. Each evidence item includes a check name, match/mismatch/unknown kind, an observed/inferred/needs-owner-verification basis, and a source line when one is available.