Guides

PR comments

Carrick comments contract-drift findings on your pull requests, posted by the GitHub App — on by default, toggled per project.

Updated  ·  view as markdown

Carrick posts a findings comment on your pull requests: type mismatches between services, changed or missing routes, wrong HTTP verbs, and dependency-version conflicts. The comment is posted by the Carrick GitHub App and updated in place on each push, so a PR never collects a stack of duplicates.

It’s on by default

PR comments are on by default for new projects. Once the GitHub App is installed on a repo and the repo is connected to a project, drift findings show up on that repo’s pull requests with no further setup.

There is no workflow step to add, no output to wire up, and no token to manage: the App authenticates itself and posts the comment for you. Your workflow file needs no pull-requests permission — see the snippet in the Quickstart.

What gets posted

On each pull request, Carrick compares the branch against the project’s index and comments when it finds contract drift:

  • A consumer calls an endpoint the producer no longer exposes, or with a mismatched method or path.
  • A request or response type no longer lines up between a producer and its consumers.
  • A dependency is pinned to a version that conflicts with the rest of the project.

When there is nothing to flag, Carrick posts a short all-clear (“All cross-service calls match the indexed contracts”) so you can tell checked and clean apart from not checked at all. Either way it is the same single comment, rewritten in place as the PR evolves — the latest state is always there rather than buried under older runs.

Turn it off

Toggle PR comments off on the project page in the dashboard at any time. Existing comments stay; no new ones are posted. Toggle it back on the same way.

Fork pull requests

Pull requests from forks are not scanned: GitHub withholds the OIDC credentials Carrick’s upload auth relies on from fork pull_request runs. The action prints a notice and exits cleanly — an external contributor’s PR is skipped, not failed, so it never turns your CI red.

  • Quickstart covers installing the App and connecting repos.
  • carrick.json classifies the outbound calls that contract checking runs against.
all docs raw markdown llms-full.txt dashboard