Start an evaluation

There is no key to request, no form to fill in and nothing to copy. Inside GitHub Actions, Presift starts your 30-day evaluation by itself the first time it runs.

What you add

name: migration-safety
on: [pull_request]
permissions:
  contents: read
  id-token: write          # lets Presift start your 30-day evaluation
jobs:
  presift:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: nishu-sde/presift@v1
        with:
          paths: db/migrations
          fail-on: error

Two things matter: uses: nishu-sde/presift@v1, and permissions: id-token: write alongside contents: read. Without that permission GitHub will not issue the job an identity token, and Presift stops with a message saying exactly that.

What happens on the first run

The client asks GitHub for the job's OIDC identity token, scoped to the Presift service.
It posts that token to the service, which verifies it against GitHub's public keys and reads two claims: the repository owner's numeric id and login. Nothing else is read, and the token is not stored.
The service records that this owner's evaluation started today and answers with a short-lived entitlement — valid for about a day, re-issued automatically on every later run, never shown to you.
The client downloads the signed Presift engine, verifies its signature and digest, and runs it on your runner. Findings appear as annotations on the pull request.

You never handle a key during the evaluation. There is nothing to store in a secret, nothing to rotate and nothing to lose.

Who can evaluate

One 30-day evaluation per GitHub owner — an organisation or a personal account. The 30 days run from the first run, across every repository that owner has.
Fork pull requests cannot evaluate. GitHub issues no identity token to a workflow triggered from a fork, so the step fails with an explicit message. Run the check on the base repository, in a merge queue, or after merge — never with pull_request_target plus a fork checkout.
Outside GitHub Actions there is no evaluation. The command-line use of Presift needs a paid organisation key.
Linux x86_64 runners, Python 3.9+. GitHub-hosted ubuntu-* runners qualify. The client refuses on anything else rather than guessing.

When something stops the run

What you see	What it means
this job may not request an OIDC token	`id-token: write` is missing from the job's `permissions:`
GitHub does not provide repository secrets … from a fork	the run came from a fork; use the base repository or a merge queue
the 30-day evaluation for '…' ended on …	the evaluation is over for that owner; continuing needs a licence — see pricing
PRESIFT_LICENSE is not a valid key	a key was supplied but is malformed — usually a truncated secret

Every refusal prints a stable error code; the full list is in the client's error reference.

After the 30 days

The check stops and says so. Continued use needs an annual organisation licence — intended at $290 per organisation per year, an initial pricing hypothesis — subject to validation. No checkout exists yet; tell us if you want one.