CLI + GitHub Action

Catch repository regressions before merge.

The current public release is v0.3.0. This site also documents the next v0.4.0 source, which must be verified from a source checkout until its release is published. RepoLens keeps repository contents out of this website.

Set up the maintenance loop Install stable v0.3.0 ↗

The repeatable loop

Review once. Check every change.

Setup creates one rule policy, one compact acceptance record, and one SHA-pinned workflow. The Action reads the base branch baseline and blocks only new or worsened findings.

01 / Accept a baseline

Record reviewed existing debt

Reason, owner, expiration, and base commit are required evidence. The baseline never updates implicitly.

repolens setup . \
  --reason "Existing findings reviewed" \
  --owner "Repository maintainers"

git add .repolens.json \
  .repolens/baselines/accepted.json \
  .github/workflows/repolens.yml
git commit -m "chore: enable RepoLens"

02 / Gate future changes

Annotate only new regressions

The generated workflow pins every external action to a full SHA. Accepted debt stays in the summary; new findings get file-and-line annotations plus SARIF.

repolens doctor .
repolens baseline check . --offline

# Pull requests cannot change the baseline
# and use that edit to approve themselves.
#
# Gate results:
#   0  no new regression
#   1  regression blocked
#   2  inspection incomplete

Results you can use

One finding model, five outputs.

The CLI and Action use the same findings, evidence identities, comparison counts, and policy result. Choose a view without changing what passed or failed.

Terminal

Prioritized findings and the next maintenance action during local work.

JSON

Machine-readable audit output for automation. Acceptance stays in a separate compact baseline.

HTML

One offline file with policy, coverage, evidence, reviewed exceptions, and limitations.

GitHub

Job summaries, new-only annotations, counts, and artifact paths.

SARIF

Stable rule IDs, fingerprints, and file locations for code scanning.

Read-only validation

RepoLens parses repository configuration and traces CI wiring. It never executes the audited scripts.

Unknown stays visible

Permission gaps, timeouts, and unavailable metadata appear as unknown and can fail strict CI.

Bounded scope

RepoLens covers the Node and GitHub maintenance contract. Dedicated scanners keep ownership of code and security analysis.

Website is documentation

Scans run in the installed CLI or pinned Action. Repository contents are never uploaded here.