{"id":51750064,"url":"https://github.com/idosal/voucha-owner-check-e2e","last_synced_at":"2026-07-18T23:39:52.883Z","repository":{"id":370353527,"uuid":"1294368227","full_name":"idosal/voucha-owner-check-e2e","owner":"idosal","description":"Public VOUCHA demo: a real GitHub PR comprehension check from policy to attestation.","archived":false,"fork":false,"pushed_at":"2026-07-14T12:42:55.000Z","size":471,"stargazers_count":0,"open_issues_count":4,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-18T23:39:28.738Z","etag":null,"topics":["ai-governance","code-review","github-app","pull-requests"],"latest_commit_sha":null,"homepage":"https://voucha.dev","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/idosal.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-08T23:06:45.000Z","updated_at":"2026-07-14T07:04:32.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/idosal/voucha-owner-check-e2e","commit_stats":null,"previous_names":["idosal/clawptcha-owner-check-e2e","idosal/voucha-owner-check-e2e"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/idosal/voucha-owner-check-e2e","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/idosal%2Fvoucha-owner-check-e2e","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/idosal%2Fvoucha-owner-check-e2e/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/idosal%2Fvoucha-owner-check-e2e/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/idosal%2Fvoucha-owner-check-e2e/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/idosal","download_url":"https://codeload.github.com/idosal/voucha-owner-check-e2e/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/idosal%2Fvoucha-owner-check-e2e/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35635260,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-18T02:00:07.223Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-governance","code-review","github-app","pull-requests"],"created_at":"2026-07-18T23:39:49.714Z","updated_at":"2026-07-18T23:39:52.870Z","avatar_url":"https://github.com/idosal.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# VOUCHA live demo\n\nThis public repository shows the complete VOUCHA workflow on a small,\ninspectable pull request: a repository policy selects the PR for a\ncomprehension check, VOUCHA asks the author to verify from GitHub, and the\nauthor completes a short challenge generated from the actual diff.\n\n**[Open the curated demo PR](https://github.com/idosal/voucha-owner-check-e2e/pull/11)**\n· **[Install VOUCHA](https://github.com/apps/voucha-checks/installations/new)**\n· **[Product site](https://voucha.dev)**\n· **[Documentation](https://voucha.dev/docs/)**\n\n![VOUCHA records the passed challenge and maintainer risk report in its managed pull request comment](docs/screenshots/voucha-custom-comment.jpg)\n\n## What this demo proves\n\n- The hosted GitHub App can apply a repository-owned policy to a real PR.\n- Owners and maintainers can be challenged when the repository opts into it;\n  they are not silently trusted by an external service.\n- Author verification happens through a one-time GitHub comment. VOUCHA never\n  receives a user token and cannot comment or answer on the author's behalf.\n- Questions come from the PR diff, while the resulting check and attestation\n  remain visible in the pull-request record.\n- Repository settings independently control passed, failed, and suspicious-pass\n  labels; the demo enables all three so their lifecycle is visible on GitHub.\n- AI assistance may be used to author and test the code. Challenge answers must\n  come from the PR author's own understanding.\n\n## Walk through the live pull request\n\n1. **Read the change.** [PR #11](https://github.com/idosal/voucha-owner-check-e2e/pull/11)\n   adds inclusive range selection to a tiny calculator, together with focused\n   Node.js tests.\n2. **Inspect the policy.** [`.github/voucha.yml`](.github/voucha.yml) removes\n   the normal owner exemption for this demo and sends the PR directly to one\n   diff-specific question.\n3. **See the GitHub handoff.** The VOUCHA check and managed PR comment link to\n   the author-verification page.\n4. **Verify authorship.** The PR author posts the displayed one-time command in\n   the PR. GitHub's signed webhook establishes who posted it.\n5. **Complete the challenge.** The author answers without agent assistance.\n   VOUCHA then updates the check and records the outcome on the PR.\n\n![VOUCHA records the completed challenge and public attestation](docs/screenshots/voucha-challenge-result.jpg)\n\n## Demo policy\n\nThe repository intentionally exercises a stricter path than VOUCHA's normal\ndefaults:\n\n```yaml\ngates:\n  - type: multiple_choice\n    questions: 1\n    pass_threshold: 1\n\ntrust:\n  default_author_associations: []\n\nrequire_approval: never\nmin_changed_lines: 0\nskip_paths: []\n\noutput:\n  comments: detailed\n  labels:\n    passed: true\n    failed: true\n    flagged: true\n  contributor_message: \u003e\n    Thanks for contributing to the VOUCHA demo, {{author}}. Please complete\n    this one-question comprehension check when you're ready.\n```\n\nIn a normal repository, owners, members, and collaborators are trusted by\ndefault, docs-only and tiny changes can be exempt, and first-time contributors\ncan require maintainer approval before a challenge is created. Repositories can\nalso use `output.contributor_message` to match the tone they use with their own\ncontributors while VOUCHA retains the challenge link and status. See the\n[configuration reference](https://voucha.dev/docs/configuration/) for the full\npolicy model.\n\nThis demo deliberately enables every outcome label. A successful challenge\nadds `VOUCHA:passed`; a failed attempt adds `VOUCHA:failed`; and a pass with\nstrong automation evidence adds `VOUCHA:flagged`. VOUCHA removes stale outcome\nlabels when the check state changes.\n\n## Run the fixture\n\nThe demo has no dependencies. Use a supported Node.js release and run:\n\n```bash\nnpm test\n```\n\nThe code is intentionally small enough that maintainers can compare every\nquestion with the underlying implementation and tests.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fidosal%2Fvoucha-owner-check-e2e","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fidosal%2Fvoucha-owner-check-e2e","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fidosal%2Fvoucha-owner-check-e2e/lists"}