feat(action): analyze, drift, and review modes for the GitHub Action - #76
Merged
Conversation
This was
linked to
issues
Jul 27, 2026
This was referenced Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
feat(action): analyze, drift, and review modes for the GitHub Action
What changed
ACT-001 — Action v1 closure. Adds
rules,ruleset,suppression-file,pull,upload-report, andreport-artifact-nameinputs. A missing rules or suppression path nowfails the run instead of silently falling back to the built-ins. Model globs are read one per
line, so a path containing a space is one path.
ACT-002 — Drift detection. New
driftmode (off/notice/fail) reports when watchedsource files changed without their threat model. Inert until
drift-watched-pathsis set, andoptionally keeps one idempotent PR comment up to date.
ACT-003 — Review mode.
review: ondiffs every threat model the PR touches against its baserevision and renders one bounded summary: new findings, trust boundary crossing changes, then
element and property changes. Full detail goes to
review.jsonin the report artifact.Supporting CLI work:
tmforge diffgained a trust boundary crossing comparison (data.crossings).tmforge analysis diff <base> <head>compares two analysis documents by finding identity.Why
Three things drove the design:
The structural diff could not see a change of exposure.
ModelDiffignores geometry, whichis what keeps it quiet on re-layout — but trust boundary containment is derived from geometry.
Verified on
examples/webshop.tm7: moving one endpoint so a flow stopped crossing bothboundaries produced the words
No differences.Crossings are now compared separately and listedwith their own budget, so a large rename sweep cannot bury them.
Counts cannot answer "what arrived". The findings delta matches on the stable
{ruleId}:{diagram}:{target}:{occurrence}identity from ANA-001, so renaming an element is not afinding change and a suppressed finding reports as reclassified rather than resolved. A changed
rule selection is warned about, never folded in.
The base analysis must see the same policy. The action analyzes the base revision at the
model's own path (head content moved aside and restored, including on failure). A suppression is
keyed by the path it was declared for, so analyzing a copy elsewhere would match no suppression
and every suppressed finding would read as one this PR suppressed.