QuickstartProof

Free repository-native check

Read two files. Execute nothing.

The JavaScript Action accepts exactly one local Markdown/MDX path and one local OpenAPI JSON/YAML path after checkout. It makes no network call, reads no repository secret, writes a bounded result to GitHub outputs, the job summary, and RUNNER_TEMP, and emits mismatch warnings plus a concise state line to the job log.

Publishing status: source and a deterministic release bundle are ready locally. The dedicated public repository, release, Marketplace agreement, and listing are not yet published. The placeholder below is not installable until that owner-controlled publication occurs.

Planned workflow

name: quickstart proof
on:
  pull_request:
    paths:
      - "docs/quickstart.md"
      - "openapi/openapi.yaml"

permissions:
  contents: read

jobs:
  proof:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@FULL_COMMIT_SHA
      # Available only after the dedicated repository is published.
      - uses: OWNER/quickstartproof-action@FULL_COMMIT_SHA
        with:
          quickstart-path: docs/quickstart.md
          openapi-path: openapi/openapi.yaml
          fail-on-changes: "false"

Three possible states

  • aligned-on-static-checks — no bounded mismatch or unresolved ambiguity was found. This is not a certification.
  • changes-found — at least one high-confidence static mismatch is tied to a quickstart source line.
  • insufficient-public-input — dynamic shell, unsupported YAML, external references, excessive scope, or another ambiguity prevents a reliable conclusion.

Hard security boundary

  • No cURL, shell block, SDK, repository script, lifecycle hook, container, or customer code is executed.
  • No token, secret, password, credential, or API-key input exists.
  • No telemetry or outbound request is made after checkout.
  • Repository-relative paths reject traversal, encoded traversal, absolute paths, unsupported types, and symlinks escaping the checkout.
  • OpenAPI references must stay internal. Bounded parsing returns UNKNOWN on unsupported syntax.
  • The action never edits repository contents or opens a pull request.

Machine output

state, a bounded result-json, and a result-file inside RUNNER_TEMP. Each evidence item includes a check name, match/mismatch/unknown kind, an observed/inferred/needs-owner-verification basis, and a source line when one is available.