# lema docs — Verify

A GitHub Action on every pull request that answers one question: did the diff do what the description says? It compares the PR's stated changes to the actual changes and reports both directions of drift — as a neutral check run with inline annotations, never a blocking gate you didn't ask for.

## What it checks

- ✓ Stated and found — a change the description claims, located in the diff.
- ✕ Stated but not found — a change the description claims that the diff does not contain.
- △ In the diff, not described — a change that shipped without being mentioned, annotated inline.

Verify does NOT review code quality, correctness, or style, and does not decide whether the change is a good idea. It checks the claim against the artifact, and stops there.

## Add it to a repo

Save as `.github/workflows/description-check.yml`:

```yaml
name: description check

on:
  pull_request:

permissions:
  contents: read
  pull-requests: write
  id-token: write
  checks: write

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
      - uses: lemahq/lema-verify@v1
        with:
          api-url: https://api.lema.sh
          github-token: ${{ github.token }}
```

No lema account, no signup — the action authenticates via GitHub OIDC. `fetch-depth: 0` matters: verify diffs the pull request against its base, so it needs history. The action takes two inputs — `api-url` and `github-token` — and nothing else.

## Authentication

- GitHub OIDC (the default) — the run proves which repo it is via GitHub's own OIDC token; no lema key to mint or rotate.
- A lema API key — outside GitHub Actions, `POST /verify` on api.lema.sh accepts a `lema_live_` key (see Connect your repo).

## Limits and failure modes

Fail-open, by design: if lema is down, slow, or over budget, the check reports that plainly and never blocks your merge. Checks meter per repo, per month — 50 free, 500 on Pro — and past an allowance the check says exactly that and when it resets. It never fails silently and never turns red because of us.