DiffShield 🛡️

Review pull request changes for common security risks before they merge. DiffShield is a dependency-free GitHub composite action that inspects only the Git diff between two commits and writes a readable report to the GitHub Actions job summary.

• Detects common credential formats and credential-like assignments in added lines. Secret values are never copied into annotations, the job summary, or the JSON report.
• Flags changed environment/key/credential files.
• Reviews changed GitHub Actions workflows for broad token permissions, unpinned external actions, direct interpolation of untrusted pull request text into run: commands (including YAML block scripts), and risky pull_request_target references.
• Notices changes to common dependency lock files.
• Adds file and line annotations, a 0–100 heuristic score, and a machine-readable diffshield-report.json.
• Runs locally on the GitHub-hosted runner, with Node.js built in. No API key, external scanner, network call, or third-party package is needed by DiffShield.

DiffShield is a review aid, not a complete security audit. The risk score is a transparent heuristic, not a probability or certification. Pattern-based secret detection can miss credentials or flag examples. Rotate any credential that may have been exposed, even after deleting it from the current diff.

Use in a repository

Add .github/workflows/diffshield.yml:

name: DiffShield
on:
  pull_request:
permissions:
  contents: read
jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - name: Check out source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # refs/tags/v4, verified against actions/checkout
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Analyze pull request changes
        uses: GhosTnever-lkm/diffshield-action@09834b2215cac582f93da7c5120279d018fcd8ce # v1.0.5
        with:
          base-sha: ${{ github.event.pull_request.base.sha }}
          head-sha: ${{ github.event.pull_request.head.sha }}
          fail-on: high

For a security-sensitive workflow, pin DiffShield itself to a reviewed full commit SHA after selecting and verifying the release commit. The @v1 example is convenient; a movable tag is not an immutable pin. Keep pull_request workflows free of repository secrets.

Inputs:

Input	Required	Default	Meaning
base-sha	yes	—	Full 40-character base commit SHA
head-sha	yes	—	Full 40-character head commit SHA
fail-on	no	high	Fail CI at critical, high, medium, or none
max-findings	no	100	Maximum findings displayed in the summary (1–1000); all findings remain in the report

Outputs: risk-score, findings-count. The step summary is available in the Actions run. diffshield-report.json is written into the checked-out workspace so later steps can upload it as an artifact if desired.

Local development

Requires Node.js 20 or newer and Git. No npm install is needed.

node --test test/scan.test.mjs

Detection scope

The secret checks cover private-key headers, common GitHub/AWS/Google/Slack/Stripe tokens, bearer credentials, and assignments to names such as password, secret, api_key, or access_token. Example placeholders such as YOUR_API_KEY and change_me are filtered. The scanner examines added diff lines, not unchanged repository history; use a dedicated history scanner if a credential may have been committed earlier.

Workflow review is intentionally conservative and line-based; it is not a full YAML parser. Review every warning in context. DiffShield does not alter files, create comments, request write permissions, or make a merge decision.

☕ Support / Pro Version

DiffShield is free and open source. There is no paid Pro edition at this time. You can support GhosTnever on Boosty or Buy Me a Coffee.

Cryptocurrency addresses

Send only the named asset on its matching network.

Network	Address
Bitcoin	bc1qn75pj4n7gyl2k5kf2f97elvyenz52q6nn2g30u
TRON	TCBSy38X57hA6w2onJcxom24x1febc1mP1
BNB Smart Chain	0xD431a917961E0b086B96D9F72b5C8fF19b19068a

License

MIT. See LICENSE.

Security

Please report vulnerabilities privately through GitHub's Report a vulnerability feature. Do not publish working credentials in issues or pull requests.

Risk score weights are fixed and visible in the source: critical 40, high 25, medium 10, low 3, capped at 100. The score is not a probability.