AI hygiene
in every PR.
Catch secrets and missing AI ignore files in CI — before Cursor, Copilot, or Claude Code read the repo.
Drop it into your workflow
The action installs offsend-cli and runs offsend check. No Homebrew, no extra setup.
- uses: actions/checkout@v4
- uses: Offsend/ai-hygiene@v1
with:
fail-on: blockWhat it catches
Same local-first checks as the CLI — on every pull request and push.
Secrets & credentials
API keys, tokens, private keys, and .env files committed to the repo — caught before they widen AI context.
AI ignore / policy gaps
Missing or incomplete .cursorignore, .aiignore, and related files that leave sensitive paths readable.
Workspace hygiene
Paths and patterns that widen what AI tools can see — so Cursor, Copilot, and Claude Code stay scoped.
Fail, warn, or scan staged only
Recommended default: fail the job on findings. For PRs you can scan only staged changes, or warn without blocking.
name: AI context check
on:
pull_request:
push:
branches: [main]
jobs:
offsend:
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v4
- uses: Offsend/ai-hygiene@v1
with:
fail-on: block- uses: Offsend/ai-hygiene@v1
with:
staged: "true"
fail-on: block- uses: Offsend/ai-hygiene@v1
with:
fail-on: warnConfigure the scan in YAML
Pin Offsend/ai-hygiene@v1 for the latest v1.x, or an exact release like @v1.0.0.
| Input | Default | Description |
|---|---|---|
path | . | Path to scan (relative to the workflow working directory) |
staged | false | Scan only git-staged files |
policy | true | Include AI ignore files and workspace policy checks |
fail-on | block | block · warn · none |
format | text | text · json |
quiet | false | Print only findings and errors |
version | 0.10.0 | offsend-cli release to install |
Try without CI
Paste a GitHub URL into Check to find exposed secrets and missing AI ignore rules — then add the Action to keep every PR clean.
FAQ
What is the Offsend GitHub Action?
Offsend/ai-hygiene is a CI check for AI-context risks: secrets in the tree, missing AI ignore files, and workspace hygiene — before Cursor, Copilot, Claude Code, and similar tools read your repo. It installs offsend-cli and runs offsend check.
How do I add it to my workflow?
After actions/checkout, add uses: Offsend/ai-hygiene@v1 with fail-on: block. That is enough for most repos. Pin @v1 for the latest v1.x or an exact release like @v1.0.0.
What does fail-on control?
fail-on: block fails the job when findings are present (recommended). warn reports findings without failing CI. none runs the scan without treating findings as a failure signal.
Can I scan only staged changes on pull requests?
Yes. Set staged: "true" so the action scans only git-staged files — useful on PRs when you want a focused diff check.
How do I tune detectors and excludes?
Commit a .offsend.yml in your repository to tune detectors, exclusions, and related policy. The action uses the same config as the CLI.
Add Offsend/ai-hygiene
Two steps in your workflow.
Installs offsend-cli and runs offsend check on pull_request and push.