gha_github_service_proof/
lib.rs

1//! GitHub Actions service/API compatibility checks for offline CI systems.
2//!
3//! `gha-github-service-proof` is the receipt-backed compatibility oracle for
4//! the GitHub side-effect surface that ci-forge and other offline runners need
5//! to model: REST endpoints, `GITHUB_TOKEN` permissions, `gh` CLI invocations,
6//! `curl`-based API requests, well-known action releases such as
7//! `softprops/action-gh-release`, OIDC token issuance, and the `/graphql`
8//! boundary.
9//!
10//! The library does not call GitHub. It classifies every requested call as
11//! `exact`, `simulated`, or `unsupported`, validates that the workflow's
12//! resolved permissions cover each call, and emits text/JSON/Markdown receipts
13//! that downstream runners can attach to job provenance.
14
15pub mod call;
16pub mod catalog;
17pub mod engine;
18pub mod gh_log;
19pub mod model;
20pub mod oidc;
21pub mod permissions;
22pub mod render;
23pub mod workflow;
24
25pub use engine::{
26    CallOptions, CheckWorkflowOptions, GhLogOptions, OidcOptions, PermissionsOptions,
27    check_workflows, classify_call, issue_oidc, permissions_command, replay_gh_log,
28};
29pub use model::{
30    Check, CheckStatus, Compatibility, GithubServiceReceipt, OutputFormat, PermissionKey,
31    PermissionLevel, PermissionScope, PermissionSet, RequiredPermission, ToolInfo,
32};
33pub use render::render_receipt;
34
35pub const TOOL_NAME: &str = "gha-github-service-proof";
36pub const TOOL_VERSION: &str = env!("CARGO_PKG_VERSION");
gha_github_service_proof/lib.rs

gha_github_service_proof/
lib.rs
