FAQ

The Action runs entirely inside your own GitHub Actions job. Without a model provider API key, no model provider is ever called, so your code is never sent to Swazona; with a key configured, the runner contacts your chosen provider only for the model tiers. Every finding — deterministic or model — surfaces as one annotation on the swazona-gate check run.

Swazona fails closed: an unreadable ruleset, an unobtainable diff, or a GitHub API error is reported as a failure, never silently skipped. In enforce mode that failure blocks the check; a pre-verdict infrastructure failure in shadow mode reports neutral instead.

No. A custom rules path is read from the base commit, never from the head checkout the pull request controls, so a PR cannot edit the rules that check it. Leaving it unset uses the ruleset bundled inside the Action, which a PR cannot edit either way.

Shadow is the default: findings are reported but never block a merge. Enforce fails the check on blocking findings; shadow reports them as neutral instead.

Download the evidence artifact and run gh attestation verify against it. No Swazona service or account is required — the artifact is JSON, its digest is recorded in the check summary and the attestation, and attestation itself is skipped on private repositories unless you set attest: true on GitHub Enterprise Cloud.

None by default. Model tiers only run once you configure a provider API key and a finder model — a key with no finder model configured fails the run rather than running with an unclear setup. With model tiers enabled, the runner contacts your configured providers, and any finding they raise is advisory unless you opt in to let it block.

Yes. The default cap is USD 2.00 of calculated model spend per run, at the rates you configure. Once a run reaches that cap, its remaining files are reported as not reviewed by the model tiers rather than reviewed for free — this is a cap on the runner's own calculation, never a guarantee from your model provider's invoice.