GitHub Action

The action fails the build when a host you list doesn’t negotiate hybrid ML-KEM key exchange, and says why, with the fix. It runs the pqdoctor CLI, so the probes are handshake-only.

name: post-quantum
on:
  pull_request:
  schedule:
    - cron: "0 6 * * 1"
permissions:
  contents: read
  pull-requests: write # only for comment: true
jobs:
  pq:
    runs-on: ubuntu-latest
    steps:
      - uses: Kalyan-Deva/flarebox/action/pqdoctor@v0.1.0 # once the repository is public
        with:
          hosts: |
            example.com
            api.example.com:8443
            ssh://git.example.com
          fail-on: not-pq
          comment: true

Inputs

Input	Default
`hosts`	(required)	One per line or comma-separated: `host`, `host:port`, `[v6]:port`, `ssh://host[:port]`. `#` starts a comment
`fail-on`	`not-pq`	`not-pq`: fail when a host answers but isn’t post-quantum (an unreachable host is a warning). `not-pq-or-unreachable`: unreachable fails too. `never`: report only
`comment`	`false`	`true`: on a pull request, add one comment with the table and update it on later runs. Needs `pull-requests: write`
`github-token`	`${{ github.token }}`	For the comment

Outputs

pq: how many hosts are post-quantum.
total: how many were checked.
report: a JSON file with every report.

Every run writes the table to the job summary. Each failing host gets an error annotation with its first fix.

How it runs

Builds pqdoctor from source at the action’s ref. It’s pure Rust with no system packages, cached with actions/cache on Cargo.lock. GitHub’s hosted runners have cargo.
Checks the hosts one at a time, because parallel probes trip servers’ rate limiters.
Exit codes follow the CLI: 0 post-quantum, 1 not, 2 unreachable.

Tested

node --test on the action’s runner script, and the script run locally against cloudflare.com and a classical lab server. It reported 1 of 2, exited with 1, and wrote the summary and outputs.