Why
The pre-commit hook only protects contributors who have installed KShield locally, and it's bypassable with git commit --no-verify. Repos with external contributors or teams that haven't onboarded everyone have no coverage. Running the same engine in CI and posting results as PR review comments extends KShield's "catch it before it reaches main" pitch to the team/CI perimeter — this is also a strong adoption/marketing surface (shows up as a check on any repo that adds it).
Proposed scope
- New
kshield-action (composite or Docker GitHub Action) that:
- Spins up (or reuses) the backend engine in the CI runner.
- Scans the diff of the PR (changed files only, not full repo, to keep it fast).
- Posts findings as inline PR review comments via the GitHub API, plus a summary check run (pass/fail).
- Respect the same suppression config (
.kshield.yml / false-positive rules) used locally so CI and local dev hooks agree.
- Publish to the GitHub Marketplace once stable.
Open questions
- Should a failing scan block merge (required check) or just annotate? Probably configurable per-repo.
- How to avoid re-scanning unchanged files on every push to keep CI fast on large PRs.
Why
The pre-commit hook only protects contributors who have installed KShield locally, and it's bypassable with
git commit --no-verify. Repos with external contributors or teams that haven't onboarded everyone have no coverage. Running the same engine in CI and posting results as PR review comments extends KShield's "catch it before it reaches main" pitch to the team/CI perimeter — this is also a strong adoption/marketing surface (shows up as a check on any repo that adds it).Proposed scope
kshield-action(composite or Docker GitHub Action) that:.kshield.yml/ false-positive rules) used locally so CI and local dev hooks agree.Open questions