Public evidence index / Platform engineering
Commit-bound feasibility receipt
Decide whether one document-extraction job belongs in GitHub Actions
A fixed-price, commit-bound check of whether your existing Python document-extraction job can run as a GitHub-hosted Actions workflow—before you allocate an implementation sprint.
Request scope reviewThe request is not checkout. It takes no payment, creates no order, and accepts no files or credentials.
Who this is for—and the decision it answers
You are a platform engineering lead at a small software organization. Somewhere in your public codebase is a working Python document-extraction job, run today by hand, by cron, or inside another CI system. Someone has asked whether it can move into GitHub Actions. Before you commit a sprint to that migration, you want a straight answer: will this exact job run in a GitHub-hosted runner, with what dependencies, what permissions, and what unresolved risk?
This receipt answers that question for one exact public commit. It does not answer it in the abstract, and it does not follow a repository that keeps changing underneath the review. The commit SHA you name is the commit we inspect and bind into the receipt.
Different from batch extraction: our existing batch service is for operations teams that send a document batch and receive extracted data. This proposed receipt is for an engineering team deciding whether to create a repository-native workflow. No customer documents are processed.
What the receipt contains
| # | Artifact | What it records |
|---|---|---|
| 1 | Commit and runtime record | The exact commit SHA reviewed, plus the GitHub-hosted runner OS, Python version, and runtime assumptions declared for the check. |
| 2 | Compatibility matrix | Runner, dependency, permissions, cache, and artifact behavior, checked item by item against the proposed workflow. |
| 3 | Draft workflow YAML | A generated GitHub Actions workflow file tied to your commit and ready for your team to review and adapt—not a merged or installed file. |
| 4 | Fixture execution record | One deterministic synthetic document run through the documented path, with per-field audit output and SHA-256 hashes for every produced artifact. |
| 5 | Threat checklist | A secrets-handling and data-egress checklist scoped to the workflow: what it would need to read, what it could send, and what stays unresolved. |
| 6 | Recommendation | IMPLEMENT, MODIFY FIRST, or DO NOT IMPLEMENT, with each reason tied to an observed check rather than a general opinion. |
The exact method
We work only from a customer-named public repository and an exact public commit. No credentials, private access, customer files, or proprietary documents enter this review.
- Fix the commit. We reproduce the public repository at the exact commit SHA you provide. That commit is the entire technical scope.
- Declare runtime assumptions. We record the Python version, runner OS, and system dependencies the job appears to require from lockfiles, requirements files, Dockerfiles, and existing public CI configuration.
- Build the compatibility matrix. We identify setup steps, dependency pins, cache boundaries, artifact movement, and the minimum permissions the proposed workflow appears to need.
- Draft the workflow. We generate a GitHub Actions YAML draft tied to the public commit and current documented workflow syntax. We do not push or install it.
- Run the fixture. We execute one synthetic, non-confidential document through the documented steps, preserve the per-field audit output, and hash each produced artifact with SHA-256.
- Read secrets and egress risk. We apply a fixed checklist to secret references, workflow permissions, artifact exposure, and outbound network behavior visible from the public job.
- Issue the recommendation. Every reason under IMPLEMENT, MODIFY FIRST, or DO NOT IMPLEMENT points back to a specific matrix, run, or checklist observation.
How the recommendation is decided
A recommendation is not a certification. It does not prove production safety, security, compliance, availability, or fitness for use. Your team owns the code review, implementation decision, merge, release, operation, and any later recheck.
If the public repository cannot be reproduced without credentials, or a preflight cannot establish a deterministic synthetic fixture path, we decline the scope before payment rather than sell a receipt that cannot reach an answer.
The public request is deliberately coarse
The request asks only for company, public repository URL, exact public commit SHA, target runtime, one-sentence workflow goal, and deadline. It takes no payment and opens no checkout or order.
Do not send repository credentials, private-repository URLs, customer files, proprietary documents, secrets, tokens, code archives, personal information, regulated data, logs, or pasted source. If the job cannot be reviewed from its public commit and a synthetic fixture, this offer is not a fit.
Timeline and correction boundary
- Request scope. Name the public repository, exact commit, runtime, workflow goal, and deadline. No files or access grants.
- Confirm reproducibility. We accept or decline the coarse scope before payment. An accepted scope pins one repository, one commit, and one workflow.
- Choose. The proposed price is USD 249 once. The public form does not charge you; payment happens only after scope acceptance.
- Receive the receipt. Delivery is within two business days after accepted scope and payment.
- Correct facts or method. One correction round within 14 days covers factual or method errors against that same commit. A new commit is a new scope.
Fictional receipt excerpt
Format illustration only. The organization, repository, commit, checks, and results below are fictional and describe no customer.
Scope: Fictional Northbridge Records Co.; one public repository at commit a1b2c3d4e5f6; Ubuntu-hosted runner; Python 3.11; no GPU assumption.
Compatibility excerpt: dependencies install from the declared requirements file; the draft uses read-only repository content permission; one package is not pinned to an exact version; output caching is not configured.
Synthetic fixture excerpt: one fictional three-page input completed the documented path; all expected fixture fields were compared to their known values; the receipt names the output and workflow-log hashes rather than presenting a green check alone.
Threat-check excerpt: no secret reference appears in the public job; outbound calls and artifact retention are named for customer review.
Fictional recommendation: MODIFY FIRST. Pin the unbounded package and set an explicit artifact-retention period before implementation. Those observations are the reason, not a claim that the workflow is secure.
Fit and not fit
| Need | Fit | Not a fit |
|---|---|---|
| One Python extraction job in a public repository | Yes | |
| One exact public commit and one workflow decision | Yes | |
| A written, artifact-hashed record before allocating a sprint | Yes | |
| A private repository or credential-gated dependency | No | |
| Validation against customer or production documents | No | |
| Implementation, merge, release, operation, or certification | No | |
| A GitHub Marketplace listing or publication | No |
Use the free path when it answers the decision
GitHub's own Actions documentation, actionlint, act for local runs, OpenSSF Scorecard, and Dependabot or pip-audit can answer many syntax, local-execution, dependency, and general security-practice questions at no cost. Do not buy this receipt if those free tools already answer your decision.
The paid value is one commit-bound record that cross-references runner compatibility, a generated workflow draft, a deterministic extraction fixture execution with per-field audit output and hashes, and a secrets/data-egress read against the same job. The public repository facts and GitHub documentation are not exclusive to us; the bounded synthesis and checkable receipt are the product.
GitHub and Marketplace boundary
Primary documentation checked 2026-08-09.
This is not a GitHub Marketplace listing and does not imply Marketplace availability, GitHub review, publication, endorsement, or installation. We do not install, push, release, publish, certify, endorse, or operate a GitHub Action for you.
A later Marketplace publication is separate from this offer. GitHub's current publication flow requires the repository or organization owner to accept GitHub's Marketplace terms. That human-controlled step is not included here and no Marketplace agreement is accepted by requesting this receipt.
Primary documentation: Publishing actions in GitHub Marketplace Workflow syntax Security hardening for GitHub Actions
Frequently asked questions
Does the fixture prove my extraction is accurate?
A synthetic fixture can test the workflow path; it cannot validate extraction accuracy for your documents. It also does not validate production safety, security, compliance, uptime, or fitness for use. It shows what one known synthetic input did under the documented assumptions.
Will you install the workflow in my repository?
No. You receive a YAML draft tied to the reviewed commit. Your team reviews, changes, merges, releases, and operates it—or decides not to.
What if the repository changes during the review?
The receipt remains bound to the accepted commit. A later commit can invalidate a dependency, permission, fixture, or threat-check observation and requires a new scope.
Is IMPLEMENT a certification?
No. It is an evidence-linked recommendation under the printed assumptions. It is not an audit opinion, warranty, security certification, compliance determination, or assurance that the workflow will remain safe or available.
What happens if the public repository will not reproduce?
If the reproducibility or deterministic-fixture boundary fails during preflight, we decline before payment. We do not ask for credentials or private access to rescue the scope.
What does the correction round cover?
One factual or method correction within 14 days against the same public commit. A feature request, implementation request, changed repository, or new workflow is outside that round.
Ask whether your exact commit is a fit
Name the public repository, exact public commit SHA, target runtime, workflow goal, and deadline. The form takes no payment and accepts no code, files, secrets, or private access.
Request the Feasibility ReceiptPublic, non-confidential repositories only. No Marketplace publication is included.