Skip to content
← All docsGitHub Action

Gate every pull request

Score PRs, post a sticky comment with the drift, and fail below your threshold.

Add the workflow

Score every pull request and comment the result. Add this to .github/workflows/norma.yml:

name: Norma
on: pull_request
permissions:
  contents: read
  pull-requests: write
jobs:
  spec-fidelity:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: norma-sh/norma@v1
        with:
          spec: "specs/**/*.md AGENTS.md"
          threshold: "80"
          pr-range: "origin/${{ github.base_ref }}...HEAD"
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}

The action posts a single sticky comment with the Spec Fidelity Score and the drift, updates it on each push, and fails the check when the score is below threshold.

Add your key as a repository secret named ANTHROPIC_API_KEY under Settings, Secrets and variables, Actions. Never commit a key. Pin version to an exact published version rather than a moving tag.

Inputs

InputDefaultWhat it does
path.Project root to check.
specautoSpec globs, space separated. Auto-detected when empty.
threshold80Score below which the check fails.
modelpackage defaultJudge model id.
provideranthropicModel provider: anthropic or openai.
remediatefalseGenerate fixes and repair prompts, and include them in the comment.
version0.1.0npm version to run. Pin to an exact version.
pr-rangewhole repoGit range to scope the run, e.g. origin/main...HEAD.
commenttruePost or update a PR comment with the report.
fail-belowtrueFail the check when the score is below threshold.
anthropic-api-keyKey for the judge when provider is anthropic.
openai-api-keyKey for the judge when provider is openai.

Output

The action exposes score (0 to 100) as a step output, so later steps can read it.

CLIConfigurationRemediation
Did the build keep its promises?

AI can write the code.
Who verifies the intent?

Run your first Norma check $ norma check