geohashim

Change gates and tooling

Checks that stop a risky change before it merges.

Four repos that check a change before it lands or ships: what an npm upgrade can newly do, what a Kubernetes admission policy would have blocked, and who gains or loses access when a permission schema changes. runon, the fourth, runs shell programs across a group of servers over SSH.

See the four repos On the landing route
Repos
4
Passing tests
523, one dot each, run in October 2026 the way each repo's CI runs them
Languages
TypeScript, Go, Python

    The four repos

    Open a repo for its project page: what it does stage by stage, with real runs.

    • permit

      36 passing tests

      What an npm upgrade can newly do

      A CLI and GitHub Action that diffs what an npm upgrade newly gets access to, such as network, install scripts, processes and environment, and blocks it until someone allows it.

      Language
      TypeScript
      Stack
      Node.js, acorn, GitHub Actions
      Counted with
      npm test

      GitHub: permit

    • admission-replay

      38 passing tests

      Admission policies replayed on the audit log

      Replays a Kubernetes cluster's audit log through a proposed admission policy, using the API server's own admission code, and reports which legitimate writes it would have blocked and which bad ones it would have let through.

      Language
      Go
      Stack
      Go, Kubernetes apiserver libraries v0.34.1, kind, GitHub Actions
      Counted with
      go test -count=1 -json ./... (30 tests plus 8 subtests)

      GitHub: admission-replay

    • authz-proof

      27 passing tests

      Who gains or loses access in a schema change

      A permission engine for SpiceDB schemas that works out who gains and who loses access when a schema or its relationships change, shows the chain behind each change, and fails the pull request when the change isn't expected.

      Language
      Go
      Stack
      Go standard library only, SpiceDB in Docker, GitHub Actions
      Counted with
      go test -count=1 -json ./... (2 of them need a live SpiceDB, as in CI)

      GitHub: authz-proof

    • runon

      422 passing tests

      Shell programs across servers over SSH

      Runs plain shell-script programs on your machine, one server, or a named group of servers over your own SSH, and is published on PyPI.

      Language
      Python
      Stack
      SSH, PyPI, stdlib only on Python 3.11+ (no runtime dependencies)
      Counted with
      pytest (3 of them need zsh or csh installed, as in CI)

      GitHub: runon