Feedback wanted: AI Change Passport for AI-assisted pull requests

[P-r-e-m-i-u-m]

I built AI Change Passport, a small GitHub Action + CLI for AI-assisted pull requests.

The idea is simple: if an AI coding agent opens or helps with a PR, maintainers should have a clear record of what changed before they review it.

It generates a signed JSON passport and a PR comment showing:

• which agent worked on the change
• changed file count and line churn
• whether auth, CI/CD, infra, env files, or payments were touched
• whether dependencies changed
• whether tests changed
• whether human approval is required
• a SHA-256 metadata signature for the generated report

Repo:
https://github.com/P-r-e-m-i-u-m/ai-change-passport

Example use:

- uses: P-r-e-m-i-u-m/ai-change-passport@v0
  with:
    agent: codex
    comment: true

It does not send source code to an AI provider. It only reads Git diff metadata.

I would really appreciate feedback from maintainers, security engineers, and anyone reviewing AI-assisted PRs:

1. What fields would you expect in an AI PR provenance report?
2. Should this align more with SBOM/SLSA/in-toto style metadata?
3. What would make this useful enough to run in a real repository?

If it looks useful, a star helps me know whether to keep building it, but honest schema/design feedback is more valuable right now.

[github-actions[bot]]

Thank you for your interest in contributing to our community! We currently only accept discussions created through the GitHub UI using our provided discussion templates. Please re-submit your discussion by navigating to the appropriate category and using the template provided.

This discussion has been closed because it was not submitted through the expected format. If you believe this was a mistake, please reach out to the maintainers.