Skip to content

octoform audit

audit inventories repositories and evaluates the root audit expectations. It never changes GitHub state.

octoform audit --config octoform.yml

Reads

  • Repositories visible for the configured owner and token.
  • Repository name, visibility, archived state, description, and topics.
  • Resolved type, including organization custom-property values when available.

It does not gather every detailed setting required by plan; audit remains a lighter inventory operation.

Output

The report lists discovered repositories, exclusions, owner context, and findings such as missing descriptions, topics, or types. Archived repositories produce no findings.

Findings are information, not command failure. audit exits 0 whether it finds zero or many findings. A pipeline that needs a compliance gate must interpret captured output itself; 0.3 has no machine-readable result mode.

Permissions and failure

The command requires a token accepted for repository reads. Authentication, invalid configuration, and GitHub API failures exit 1. A missing token never falls back to credentials embedded in configuration because token fields are not accepted.

Use the scheduled-audit example and CI/CD guide for a read-only automation boundary.