Nika × GitHub Actions

supernovae-st/nika-action turns every PR that touches a .nika.yaml into a reviewed plan: a sticky comment with the nika check verdict, the cost floor (never a fake zero), the models and secrets the change needs, its egress statics, and the DAG — rendered natively by GitHub as mermaid.

name: nika
on:
  pull_request:
    paths: ['**.nika.yaml']  # fire only when a workflow file changes
permissions:
  contents: read
  pull-requests: write     # drop it and the body lands in the step summary
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # in real use, pin by full commit SHA with the release in a comment —
      # the form Dependabot/Renovate bump: @<sha> # v1.0.2
      - uses: supernovae-st/nika-action@v1
        with:
          workflow: flows/report.nika.yaml
          mode: check        # or: test → adds the offline mock golden lane

No workflow yet? nika new chain flows/report.nika.yaml scaffolds one — authoring in 10 minutes.

Already have CI? One line

The starter repo publishes a reusable workflow that wraps the action with the same fork-safe posture — adopting the check in an existing repo is a single uses: block:

jobs:
  nika:
    permissions:
      contents: read
      pull-requests: write
    uses: supernovae-st/nika-actions-starter/.github/workflows/nika-check.yml@main
    with:
      workflow: path/to/your.nika.yaml

Starting fresh instead? nika-actions-starter is a template repo — Use this template, and the verdict lands on your first PR with zero further wiring. Its own pull requests run the check live, so you can read a real sticky comment before adopting anything.

What lands on the PR

✅ nika check — clean · flows/report.nika.yaml · 3 task(s) · 3 wave(s) 💰 **cost floor ≥ $0.12** · ⚠ 1 unpriced task — never rendered as$ 0 🔐 requires — models: ollama/qwen3.5:4b · mistral/mistral-small-latest · secrets: MISTRAL_API_KEY 🌊 schedule — 3 wave(s), max width 1 🗺 DAG (collapsible mermaid)

One comment per workflow file, upserted in place on every push — never thread spam.

The lanes — and the missing one

lane	runs	secrets
`check` (default)	static analysis only, nothing executes	none
`test`	+ `nika test` vs `<file>.golden.json` — mock provider, offline	none
~~run~~	refused by design. A `.nika.yaml` can declare `exec:` shell steps — executing PR content under a CI token is your decision to make explicitly, in your own workflow, never on fork-origin events	—

Security posture

The engine download is verified against the release’s SHA256SUMS before extraction.
Fork PRs carry a read-only token: the comment degrades to the step summary automatically. Never wire any of this via pull_request_target with a checkout of the PR head.
Pin the action itself by commit SHA — the marketplace norm.

Honesty semantics

The comment’s cost figure is a floor (spend ≥ floor); unpriced tasks render as unpriced with their reason verbatim, never $0. When the DAG has parallel waves the comment states the budget bound explicitly: a mid-run --max-cost-usd stops new admissions, so the worst-case overshoot is one full wave (spend ≤ floor + W · c_max). The full semantics: cost honesty.

Overview

Getting started

Agents & integrations

Concepts

Nika × GitHub Actions

Already have CI? One line

What lands on the PR

The lanes — and the missing one

Security posture

Honesty semantics

​Already have CI? One line

​What lands on the PR

​The lanes — and the missing one

​Security posture

​Honesty semantics

Already have CI? One line

What lands on the PR

The lanes — and the missing one

Security posture

Honesty semantics