Documentation

Everything you need to add ResourcePulse to your Bicep workflow.

Overview

ResourcePulse is a GitHub Action that analyzes Azure Bicep files in pull requests, posting a cost delta and governance findings comment — no Azure subscription access required.

Preview — Free, no signup. Uses GitHub OIDC.
Starter — $29.99/mo. API key, 3 repos, 1,000 analyses/month.
Team — $79.99/mo. API key, 10 repos, 5,000 analyses/month.

Quick start

Preview — free, no signup

Add id-token: write permission. The action requests a GitHub OIDC token automatically — no API key needed.

name: IaC Review

on:
  pull_request:
    paths: ['**/*.bicep', '**/*.bicepparam']

permissions:
  contents: read
  pull-requests: write
  id-token: write          # required for preview OIDC auth

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: resourcepulse-io/azure-iac-reviewer@v1
        with:
          param_file: infra/params/dev.bicepparam
          comment_mode: update
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Starter / Team — API key

Add your API key as a repository secret (RESOURCEPULSE_API_KEY), then pass it as api_key. You can omit id-token: write.

- uses: resourcepulse-io/azure-iac-reviewer@v1
  with:
    api_key: ${{ secrets.RESOURCEPULSE_API_KEY }}
    param_file: infra/params/dev.bicepparam
    comment_mode: update
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Inputs & outputs

Inputs

Input	Required	Default	Description
`api_key`	No	—	API key for Starter/Team plans. If omitted, preview mode via OIDC is used.
`param_file`	No	—	Path to a .bicepparam file. Required for region resolution and cost estimates.
`comment_mode`	No	`update`	update — edit existing comment in place. new — post a new comment each run.
`main_region`	No	—	Fallback region (e.g. westeurope) when no param_file is available.
`env`	No	—	Environment hint for policy selection: dev, staging, or prod.

Outputs

Output	Description
`resources_detected`	Number of Azure resources detected in changed Bicep files.
`analysis_status`	Result of the analysis: success, partial, or failed.

Region resolution

Cost estimates require a region. Provide one of the following — if neither is set, cost rows will show a notice instead of an estimate.

param_file (recommended) — Path to a .bicepparam file. The action parses param location = '...' automatically.
main_region — Explicit fallback region string, e.g. westeurope. Used when param_file is not available.

If resourceGroup().location is used in your Bicep, it will be marked as unresolved unless a fallback is configured. The PR comment always discloses what was resolved and what was assumed.

Supported resources

Cost-estimated

These resources produce a monthly cost row in the PR comment.

Resource	ARM type
Virtual Machines	`Microsoft.Compute/virtualMachines`, `Microsoft.Compute/virtualMachineScaleSets`
App Service	`Microsoft.Web/serverfarms`, `Microsoft.Web/sites`
Azure Kubernetes Service	`Microsoft.ContainerService/managedClusters`
Azure SQL Database	`Microsoft.Sql/servers/databases`
PostgreSQL Flexible Server	`Microsoft.DBforPostgreSQL/flexibleServers`, `Microsoft.DBforPostgreSQL/servers`
Azure Cache for Redis	`Microsoft.Cache/redis`
Storage Accounts	`Microsoft.Storage/storageAccounts`
Container Registry	`Microsoft.ContainerRegistry/registries`
Service Bus	`Microsoft.ServiceBus/namespaces`
API Management	`Microsoft.ApiManagement/service`
Key Vault	`Microsoft.KeyVault/vaults`

PostgreSQL note — only modern compute series are estimatable (Dadsv5, Ddsv5). Legacy Dsv3 SKUs show as "Coverage in progress".

Consumption-based (no fixed cost)

Tracked in findings and rulesets, but cost estimation requires actual usage data.

Resource	ARM type
Container Apps	`Microsoft.App/containerApps`
Azure Functions	`Microsoft.Web/sites` (kind: functionapp)
Cosmos DB	`Microsoft.DocumentDB/databaseAccounts`
Application Insights	`Microsoft.Insights/components`

Free / infrastructure-only

Tracked for ruleset findings (e.g. missing tags). No cost row produced.

Resource	ARM type
Virtual Networks	`Microsoft.Network/virtualNetworks`
Network Security Groups	`Microsoft.Network/networkSecurityGroups`

Required permissions

Add these to your workflow-level permissions block:

permissions:
  contents: read        # read repo files and PR diff
  pull-requests: write  # post / update PR comment
  id-token: write       # preview OIDC auth (omit if using api_key)

Privacy

Transmitted (anonymized metadata only)

Resource types (e.g. Microsoft.Storage/storageAccounts)
SKUs (e.g. Standard_GRS)
Azure regions (e.g. westeurope)
Resource counts and change types
Tag keys only (values are stripped)

Never transmitted

Source code
Resource names or IDs
Tag values
Secrets or connection strings
Any personally identifiable information

Troubleshooting

No comment appears

Confirm the workflow triggers on pull_request
Confirm pull-requests: write permission is set
Confirm at least one .bicep file changed in the PR

Cost shows "Add param_file..."

Add param_file: path/to/your.bicepparam to the action inputs
Or add main_region: westeurope

Backend returns 401

Preview: confirm id-token: write is in the workflow permissions
Starter/Team: verify the api_key secret is set correctly

Compilation errors in comment

Fix the Bicep syntax errors shown — the action continues analyzing other valid files