Catching AI bugs in pull requests prevents unreliable code from ever reaching staging or production. AI Guard natively outputs standard SARIF 2.1.0 (Static Analysis Results Interchange Format) supported by GitHub Advanced Security.

Drop-in Workflow

Create .github/workflows/ai-guard.yml in your repository:

yaml

name: AI Guard

on:
  pull_request:
    branches: [main, master]
  push:
    branches: [main, master]

permissions:
  contents: read
  security-events: write

jobs:
  ai-guard:
    name: AI Guard Code Safety
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0 # Full Git history needed for PR changed-file detection

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install Dependencies
        run: npm ci

      - name: Run AI Guard PR Scan
        run: |
          npx ai-guard changed \
            --pr \
            --strict \
            --sarif \
            --sarif-output ai-guard-results.sarif \
            --fail-on errors

      - name: Upload SARIF to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: ai-guard-results.sarif
          category: ai-guard

GitHub Code Scanning & SARIF 2.1.0

When the SARIF file is uploaded to GitHub Code Scanning: - Findings appear under the repository's Security → Code scanning alerts tab. - Alerts are tracked across branches and commits automatically. - Fixed alerts are automatically marked as resolved when merged.

Inline PR Annotations

GitHub Actions automatically places inline review warnings and errors directly on the pull request diff at the exact line of code containing the defect. Developers see the explanation and suggested fix without leaving their code review window.

Fast Differential PR Scans

By running ai-guard changed --pr, the scanner inspects only the files changed between your pull request branch and target base branch. Scans finish in 1 to 2 seconds, ensuring CI checks remain instantaneous.

GitLab CI Integration

For teams using GitLab CI/CD, add this block to your .gitlab-ci.yml: