AI hygiene
in every PR.
Catch secrets, ignore drift, and policy gaps in CI — before Cursor or Claude Code read the repo.
Drop it into your workflow
The action installs offsend-cli and runs offsend check. No Homebrew, no extra setup.
- uses: actions/checkout@v4
- uses: Offsend/ai-hygiene@v1
with:
fail-on: block
policy: trueWhat it catches
Secrets, ignore drift, and policy — the same local-first checks, without requiring git or editor hooks on the runner.
Secrets & credentials
API keys, tokens, private keys, and .env files committed to the repo — caught before they widen AI context.
Managed ignore drift
AI ignore files that drifted from .offsend.yml — plus policy checks. CI does not fail because git or editor hooks are missing on the runner.
Open paths in policy
Exposed paths and incomplete ignore rules that widen what Cursor or Claude Code can read from the repo.
Fail, warn, or scan staged only
Recommended default: fail the job on findings. For PRs you can scan only staged changes, or warn without blocking.
name: AI context check
on:
pull_request:
push:
branches: [main]
jobs:
offsend:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: Offsend/ai-hygiene@v1
with:
fail-on: block
policy: true- uses: Offsend/ai-hygiene@v1
with:
staged: "true"
fail-on: block- uses: Offsend/ai-hygiene@v1
with:
fail-on: warnConfigure the scan in YAML
Pin Offsend/ai-hygiene@v1 for the latest v1.x, or an exact release like @v1.0.0.
| Input | Default | Description |
|---|---|---|
path | . | Path to scan (relative to the workflow working directory) |
staged | false | Scan only git-staged files |
policy | true | Include AI ignore files and workspace policy checks |
fail-on | block | block · warn · none |
format | text | text · json |
quiet | false | Print only findings and errors |
version | latest via @v1 | Leave unset. The action installs the current offsend-cli through @v1. |
Try without CI
Paste a GitHub URL into Check to find exposed secrets and ignore gaps — then add the Action to fail PRs on secrets, drift, and policy.
FAQ
What is the Offsend GitHub Action?
Offsend/ai-hygiene is a CI check for secrets, managed ignore drift, and .offsend.yml policy — before Cursor, Claude Code, and similar tools read your repo. It installs the latest offsend-cli via @v1 and runs offsend check --policy. It does not fail because git or editor hooks are missing on the runner.
How do I add it to my workflow?
After actions/checkout, add uses: Offsend/ai-hygiene@v1 with fail-on: block and policy: true. Pin @v1 for the latest v1.x or an exact release like @v1.0.0. Do not pin an old CLI version input.
What does fail-on control?
fail-on: block fails the job when findings are present (recommended). warn reports findings without failing CI. none runs the scan without treating findings as a failure signal.
Can I scan only staged changes on pull requests?
Yes. Set staged: "true" so the action scans only git-staged files — useful on PRs when you want a focused diff check.
How do I tune detectors and excludes?
Commit a .offsend.yml in your repository to tune detectors, exclusions, and related policy. The action uses the same config as the CLI.
Add Offsend/ai-hygiene
Two steps in your workflow.
Installs the latest offsend-cli via @v1 and runs check --policy.