Add trusted native skill comparison subaction

README.md

@@ -5,6 +5,10 @@ sticky PR comment** with the suite, eval names, verdicts, and evidence links.
 Vally owns selection, execution and grading; the Action handles installation
 and GitHub integration.
 
+For approval-gated Before/After skill comparisons from a trusted `workflow_run`,
+use the separate [comparison subaction](comparison/README.md). The root Action's
+event and checkout policy is unchanged.
+
 Use `github/evals-action@v0` for the latest 0.x pilot release
 (currently [v0.1.0](https://github.com/github/evals-action/releases/tag/v0.1.0)).
 Use `@v0.1.0` to stay on that specific Action release. The `v0` tag advances as

comparison/action.yml

@@ -0,0 +1,47 @@
+name: Compare skill evals
+description: Authenticate a source PR, run native Before/After arms, or publish bounded comparison projections.
+inputs:
+  command:
+    description: context, run, or report. Call each in its separately permissioned job.
+    required: true
+  source-workflow:
+    description: Exact trusted source workflow path, for example .github/workflows/skill-evals.yml.
+    required: true
+  github-token:
+    description: Job-scoped GitHub token for authenticated provenance and, only in report, commenting.
+    default: ${{ github.token }}
+  copilot-token:
+    description: Explicit execution credential, only in the approval-gated run job.
+  context:
+    description: Exact context output from the trusted selection job, never from an artifact.
+  selection:
+    description: Exact schema documented in comparison/README.md, from trusted selection job output.
+  producing-attempt:
+    description: Selection job's producing attempt. Required on run/report to reject partial paid retries and bind publisher retries.
+  comparison-id:
+    description: Selected include entry id for this run job.
+  working-directory:
+    description: Candidate merge checkout relative to GITHUB_WORKSPACE, for run only.
+  vally-version:
+    description: Exact stable native Vally version for run; latest is deliberately unsupported here.
+    default: '0.21.0'
+  artifact-directory:
+    description: Absolute downloaded projection directory, for report only. Contents are untrusted JSON data.
+outputs:
+  context:
+    description: Authenticated source/producer/PR/trusted-workflow/merge identity from context.
+  context-path:
+    description: Private local context.json path for the trusted repository selector; not an artifact authority.
+  merge:
+    description: Current verified PR merge SHA from context.
+  projection-directory:
+    description: Run's private output directory; do not upload recursively.
+  before-path:
+    description: Exact allowlisted Before JSON projection path.
+  after-path:
+    description: Exact allowlisted After JSON projection path.
+  outcome:
+    description: passed/failed for run, posted/stale for report. Posting never changes a native failure.
+runs:
+  using: node24
+  main: ../dist/comparison-index.cjs

dist/THIRD-PARTY-NOTICES.txt

@@ -1,9 +1,9 @@
 THIRD-PARTY NOTICES
 GitHub Evals Action
 
-This inventory describes packages contributing code to dist/index.cjs.
+This inventory describes packages contributing code to dist/index.cjs and dist/comparison-index.cjs.
 License text inclusion is evidence, not release approval. Missing terms remain unresolved.
-Inline third-party comments are retained separately in index.cjs.LEGAL.txt.
+Inline third-party comments are retained separately in index.cjs.LEGAL.txt and comparison-index.cjs.LEGAL.txt.
 
 ========================================================================
 Package: @actions/artifact

dist/comparison-index.cjs.LEGAL.txt

@@ -0,0 +1,7 @@
+Bundled license information:
+
+undici/lib/web/fetch/body.js:
+  /*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
+
+undici/lib/web/websocket/frame.js:
+  /*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> */