Show HN: GitHub Action to check AI-written code changes no files, without review

A developer released a GitHub Action, yuyuyuyuyu-dev/assert-no-unexpected-changes, that runs an AI-written code change in two Docker containers — one executing only the `arrange` setup phase and one running both `arrange` and `act` — then compares them with `docker diff` to flag files created, changed or deleted outside a user-supplied allowlist. The action fails the step with an error such as "2 change(s) outside the allowlist" when violations appear, and is configured through `arrange`, `act`, `allowlist`, `workdir` and `image` inputs on a Linux runner. The author built it after deciding that "something strange" from AI-generated code most plausibly means files deleted or rewritten without the user's knowledge.

This action asserts that your desktop app, CLI tool or anything else makes no unexpected changes. Table of Contents This GitHub Action was built to verify that code an AI wrote does nothing "strange", treating the code as a black box. I was about to post on social media that I had built a desktop app when a thought stopped me: if I say an AI built it, some people are going to worry that it will do something strange to their machine. So I asked myself what "something strange" would actually be, and the first answer that came to mind was files deleted or rewritten behind their back. Nothing seemed to exist that would catch it, and if a thing does not exist, you may as well make it, so I wrote this action. This action prepares two Docker containers: one runs only the arrange phase, and the other runs both the arrange and act phases. More precisely, it writes a Dockerfile that starts from image , copies the workspace GITHUB WORKSPACE into workdir with COPY and runs the arrange phase, and builds an image from it. From that image it starts two containers, runs the act phase in only one of them, and runs docker diff on both. Then it checks the difference between the two containers against allowlist to detect violations. If there are any, the step fails with an error like this: Error: 2 change s outside the allowlist A /unexpected D /expected A means created, C means changed and D means deleted. Please replace ${checkout-latest-version} and ${this-action-latest-version} with the latest version numbers, such as v1 . runs-on: ubuntu-latest Must be a Linux runner. steps: - uses: actions/checkout@${checkout-latest-version} - uses: yuyuyuyuyu-dev/assert-no-unexpected-changes@${this-action-latest-version} with: arrange: | Optional. Run in sh . Its changes are not checked. some-setup-commands for-example-install-the-dependencies build-the-thing or-anything-else act: | Run in sh . Its changes are checked. some-commands-to-verify for-example-run-tests ./the-built-executable or-anything-else allowlist: | Optional. Absolute paths that may change, one per line. also matches / . /this/path/alone /everything/below/this/ workdir: /path/to/workdir Optional. Defaults to /workdir . Changes under it are not checked. image: some-image:a-tag Optional. Defaults to Ubuntu. Must run as root to change the copied workspace.