Review Shopify app configuration changes in CI with semantic diffs and risk findings.
RexCode Open Source · Shopify developer tools
ChangeGuard compares supported Shopify app configuration fields and explains semantic risks before changes are merged or deployed. It is a read-only CLI and GitHub Action; Shopify CLI remains responsible for validating the complete configuration schema.
- Explains changes to supported app configuration fields rather than only printing a text diff.
- Classifies baseline findings as new, existing or resolved with deterministic fingerprints.
- Redacts sensitive values and validates paths and Git references.
- Uses the same report model in the CLI and Action.
Requires Node.js 22 or later.
npm install --save-dev shopify-app-changeguard
npx changeguard --before path/to/before.toml --after path/to/after.tomlCompare two files or a Git range. Run npx changeguard --help for the available options, or read the CLI guide.
Pin the reviewed v0.7.0 release commit:
name: Review Shopify app configuration
on: [pull_request]
permissions:
contents: read
jobs:
changeguard:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
- uses: RexCode-Digital/shopify-app-changeguard@1ad900a2dc4d8b83305642611a89ea8eb30e165a # v0.7.0
id: review
with:
base_sha: ${{ github.event.pull_request.base.sha }}
head_sha: ${{ github.event.pull_request.head.sha }}
fail_on: unreviewedInputs include base_sha, head_sha, fail_on, fail_on_risk, baseline_path and fail_on_new. Outputs include the outcome, finding and baseline counts, highest severity/risk, reviewed and unreviewed file counts, rule IDs and JSON report. See the full Action interface.
ChangeGuard v0.7.0
Only documented semantic changes in supported Shopify app configuration fields are examined; Shopify CLI remains responsible for schema validation and unsupported fields are not checked.
[REVIEW] SCOPE_OPTIONAL_TO_REQUIRED: scope changed from optional to required: read_products
1 finding(s).
This is the output for the repository's synthetic before/after fixtures.
ChangeGuard recognises a documented subset of Shopify app configuration fields. It reports supported semantic changes and risk rationale; it does not validate every TOML field or replace Shopify CLI. See supported rules, the risk model, and the support matrix.
ChangeGuard does not call Shopify APIs, require Shopify credentials, execute repository code, or send configuration to a service. Static review cannot establish whether unsupported fields are valid or guarantee deployment safety. Use synthetic fixtures in issues and remove tokens, client secrets, private URLs, webhook destinations and merchant data.
- Shopify Upgrade Guard checks documented API and platform migration risks.
- Shopify Scope Guard reviews declared scopes against supported static evidence.
- Shopify App Review Guard reports App Store and production-readiness evidence.
See the four-tool workflow example.
Read CONTRIBUTING.md and the RexCode Open Source standards. Use SUPPORT.md or the issue tracker for safe usage questions and reproducible reports.
Report suspected vulnerabilities privately through SECURITY.md. Do not include production configuration or secrets in public issues.
MIT licensed. Shopify and related marks are owned by their respective holders. ChangeGuard is independent open-source software and is not affiliated with, endorsed by, or certified by Shopify.