Feedback wanted: AI Change Passport for AI-assisted pull requests

[P-r-e-m-i-u-m]

🏷️ Discussion Type

Question

Body

I built AI Change Passport, a GitHub Action + CLI for AI-assisted pull requests.

It creates a signed JSON passport and PR comment showing:

• which agent worked on the change
• sensitive files touched
• dependency changes
• workflow changes
• test-change signal
• risk score
• whether human approval is required

Repo:
https://github.com/P-r-e-m-i-u-m/ai-change-passport

I would appreciate feedback from maintainers and security engineers:

1. What metadata should an AI-assisted PR report include?
2. Should this align with SBOM, SLSA, or in-toto style provenance?
3. What would make this useful enough to run in real repositories?

It does not send source code to an AI provider. It only reads Git diff metadata.