GitHub Actions

After the shared setup commit is on the default branch, copy the workflow to .github/workflows/marginci.yml. Commit an exact MarginCI devDependency and lockfile. Configure only the secrets your operation uses. Required external registry publication/private distribution must already be available to the runner.

The workflow compares PR head, not GitHub’s synthetic merge result, against github.event.pull_request.base.sha from that event. Checkout explicitly selects head.sha and fetches full history. MarginCI resolves the baseline to an immutable commit, records the candidate HEAD and snapshot digest, and runs each side’s application/dependency graph. If the base SHA is missing or shared setup predates it, the job fails before provider work. It does not silently choose a moving origin/main ref.

The workflow uses pull_request, read-only contents permission, disabled persisted Git credentials, a job timeout, pinned verified third-party action commits, Node 25.3.0, npm ci --ignore-scripts, and the local locked binary. There is no implicit npx download. Secrets are exposed only to the economic test step, for code from trusted internal branches. Internal contributors and workflow changes must be trusted by the repository owner; same-repository membership alone is not a sandbox or an independent security review. Add protected environments/approvals if your trust policy requires them.

Fork PRs fail the job with an explicit INCONCLUSIVE explanation before checkout or secret-bearing execution. Do not convert this into a green skipped economic gate. A maintainer may inspect a fork change and move reviewed code to a trusted internal branch, then run a new comparison under that branch’s event and immutable SHAs. Do not use pull_request_target with arbitrary PR code and secrets.

The owner must separately configure the MarginCI job/check as required in branch protection/rulesets. Only a completed economic PASS may approve it. Do not enable the required check until bootstrap is landed. Baseline and workload changes still require review; a green cost result does not establish application quality.

The workflow runs this command:

mkdir -p .marginci
./node_modules/.bin/marginci test research --against "$MARGINCI_BASE_SHA" --json > .marginci/ci-report.json

The example consumer workflow’s Linux execution, provider-secret delivery, fork rejection and required-check enforcement have not been verified in an actual GitHub event environment. Local runtime validation does not establish those policies. Validate this check in your own trusted repository before depending on its enforcement, including runner compatibility, credential delivery, fork rejection and the required-check configuration. See the support boundary.