{"id":50448252,"url":"https://github.com/decionis/govern","last_synced_at":"2026-05-31T23:01:26.861Z","repository":{"id":361692521,"uuid":"1255419642","full_name":"decionis/govern","owner":"decionis","description":"Govern any GitHub workflow step on a signed Decionis Decision Dossier — gate deploys, releases, and infra changes; shadow or enforce.","archived":false,"fork":false,"pushed_at":"2026-05-31T21:57:54.000Z","size":22,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-31T22:10:28.785Z","etag":null,"topics":["ci-cd","compliance","deployment","github-actions","governance","security"],"latest_commit_sha":null,"homepage":"https://decionis.com/marketplace/github","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/decionis.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-31T20:03:15.000Z","updated_at":"2026-05-31T21:57:56.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/decionis/govern","commit_stats":null,"previous_names":["decionis/govern"],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/decionis/govern","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/decionis%2Fgovern","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/decionis%2Fgovern/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/decionis%2Fgovern/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/decionis%2Fgovern/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/decionis","download_url":"https://codeload.github.com/decionis/govern/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/decionis%2Fgovern/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33752286,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-31T02:00:06.040Z","response_time":95,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ci-cd","compliance","deployment","github-actions","governance","security"],"created_at":"2026-05-31T23:01:23.196Z","updated_at":"2026-05-31T23:01:26.855Z","avatar_url":"https://github.com/decionis.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🛡️ Decionis Action Gate\n\n**Govern high-risk actions before they execute.**\n\n[![Marketplace](https://img.shields.io/github/v/release/decionis/govern?label=marketplace\u0026logo=githubactions\u0026logoColor=white\u0026color=6D28D9)](https://github.com/marketplace/actions/decionis-action-gate)\n[![Governed by Decionis](https://img.shields.io/badge/Governed%20by-Decionis-6D28D9?logo=shield\u0026logoColor=white)](https://github.com/decionis/govern)\n[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)\n\n\u003e **Before software executes, Decionis decides whether it's allowed to.**\n\nGitHub Actions runs the code. **Decionis decides whether the run is authorized.** Add one step and every deploy, migration, infra change, or AI-generated PR is evaluated against your policy, approvals, and risk — then **allowed, blocked, or escalated** before it executes, with a signed Decision Dossier as audit-ready proof.\n\nStart in **shadow mode**, where it _never fails your build_ — observe what it would have caught, then flip one line to `enforce`.\n\n---\n\n## The question every pipeline now faces\n\nAI coding agents — **Claude Code, Copilot, Cursor, Codex, OpenHands** — now open PRs, edit workflows, write migrations, and trigger deploys. The hard question is no longer _\"who wrote this code?\"_ It's:\n\n\u003e **Should this action be allowed to execute?**\n\nThat's the Action Gate.\n\n## 30-second quickstart\n\n**Wrap the command you want to govern.** Decionis runs it _through_ the gate, so it can't execute without an authorizing verdict:\n\n```yaml\n- uses: decionis/govern@v1\n  with:\n    api-key: ${{ secrets.DECIONIS_API_KEY }}\n    org-id: ${{ secrets.DECIONIS_ORG_ID }}\n    workflow-key: github_deploy_approval\n    action: production-deploy\n    run: ./deploy.sh # ← Decionis runs this ONLY if it authorizes the action\n```\n\nOn `allow` the command runs. On `block`/`escalate` it **never runs** and the step fails. Try it risk-free with `mode: shadow` — the command still runs, but Decionis only records the verdict (never fails the build):\n\n```yaml\n- uses: decionis/govern@v1\n  with:\n    api-key: ${{ secrets.DECIONIS_API_KEY }}\n    org-id: ${{ secrets.DECIONIS_ORG_ID }}\n    workflow-key: github_deploy_approval\n    action: production-deploy\n    run: ./deploy.sh\n    mode: shadow # observe-only; records the verdict, never blocks\n    comment-pr: \"true\" # posts the verdict + verify link on the PR\n```\n\nNeed keys? Create them free at **[decionis.com/quickstart?source=github_action](https://decionis.com/quickstart?source=github_action)** — no card, no call.\n\n### Why a wrapper, not an `if:`\n\nA common pattern is to gate on the output:\n\n```yaml\n- uses: decionis/govern@v1\n  id: gate\n- run: ./deploy.sh\n  if: steps.gate.outputs.decision == 'allow' # ⚠️ advisory — can be deleted\n```\n\nThat `if:` is **advisory**. Anyone — or any AI agent editing the workflow — can delete one line and the deploy runs ungoverned. With `run:`, **Decionis owns the execution path**: the command only exists inside the gate, so bypassing it means rewriting the step — a visible, reviewable diff (protect `.github/workflows/**` with CODEOWNERS + branch protection to close that too). The verdict-only + `if:` form still works for cases where you can't wrap the command, but reach for `run:` whenever you actually need to _enforce_.\n\n---\n\n## Three concepts\n\n### 1. 🚦 Action Gate\n\nOne verdict before execution — **`allow`**, **`block`**, or **`escalate`**. Composable into any later step via `steps.\u003cid\u003e.outputs.decision`.\n\n### 2. 🟣 Shadow Mode\n\n`mode: shadow` records what _would_ have been blocked without ever failing a build. Watch the would-have-blocked numbers, then enforce when the evidence convinces you.\n\n### 3. 🧾 Decision Dossiers\n\nEvery verdict produces a signed, public-verifiable [Decision Dossier](https://decionis.com/dossier-example?source=github_action): **why** it happened, **who** approved it, **which policy** applied, and the **risk**. The verify link unfurls as an OG card in Slack / Teams / LinkedIn — paste it in an incident, a change ticket, or an audit and it holds up.\n\n---\n\n## Lead use case — govern AI-generated changes\n\nWhen an AI agent opens a PR or triggers a deploy, gate it **before** it merges or ships:\n\n```yaml\n- uses: decionis/govern@v1\n  id: gate\n  with:\n    api-key: ${{ secrets.DECIONIS_API_KEY }}\n    org-id: ${{ secrets.DECIONIS_ORG_ID }}\n    workflow-key: ai_change_gate\n    action: ai-generated-pr\n    comment-pr: \"true\"\n    payload: |\n      { \"author\": \"${{ github.actor }}\", \"agent_generated\": true }\n```\n\nSee [`examples/gate-ai-agent-pr.yml`](./examples/gate-ai-agent-pr.yml) for the full recipe (auto-detects agent authorship and requires a human verdict on risky changes).\n\n## Also governs\n\n- **Deployments** — production releases, blue/green cutovers\n- **Infrastructure** — `terraform apply`, Pulumi, CDK\n- **Data** — database migrations, destructive jobs\n- **Privileged workflows** — release pipelines, secrets rotation, IAM changes\n\n## What reviewers see on the PR\n\nA single, **self-updating** comment (re-runs edit it in place — no thread spam):\n\n![Example Decionis PR comment — Blocked verdict with a signed verify link](./assets/pr-comment.svg)\n\n## 📌 Add the badge\n\nShow your pipeline is governed — and let other devs discover the gate. Also emitted as the `badge-markdown` output (pointing at the live verify URL):\n\n```markdown\n[![Governed by Decionis](https://img.shields.io/badge/Governed%20by-Decionis-6D28D9?logo=shield\u0026logoColor=white)](https://github.com/decionis/govern)\n```\n\n[![Governed by Decionis](https://img.shields.io/badge/Governed%20by-Decionis-6D28D9?logo=shield\u0026logoColor=white)](https://github.com/decionis/govern)\n\n---\n\n## Recipes\n\nCopy-paste workflows in [`examples/`](./examples/):\n\n| Recipe                                                              | What it gates                                                  |\n| ------------------------------------------------------------------- | -------------------------------------------------------------- |\n| [`gate-ai-agent-pr.yml`](./examples/gate-ai-agent-pr.yml)           | AI-generated PRs (Claude Code, Copilot, Cursor…) before merge. |\n| [`gate-deploy.yml`](./examples/gate-deploy.yml)                     | A production deploy on a `block` verdict (enforce).            |\n| [`gate-terraform.yml`](./examples/gate-terraform.yml)               | `terraform apply` on the plan's blast radius.                  |\n| [`gate-release.yml`](./examples/gate-release.yml)                   | A verdict before a tagged release ships.                       |\n| [`auto-merge-dependabot.yml`](./examples/auto-merge-dependabot.yml) | Auto-merge a dependency PR only when the verdict is `allow`.   |\n| [`gate-pr-comment.yml`](./examples/gate-pr-comment.yml)             | Shadow-mode evaluator that comments without failing the build. |\n\n## Inputs\n\n| Input                | Required | Default                       | Description                                                        |\n| -------------------- | -------- | ----------------------------- | ------------------------------------------------------------------ |\n| `api-key`            | yes      | —                             | Decionis API key with `protocol:evaluate` scope. Pass as a secret. |\n| `org-id`             | yes      | —                             | Decionis org id (UUID).                                            |\n| `workflow-key`       | yes      | —                             | Workflow key registered in Decionis policy.                        |\n| `action`             | no       | —                             | Short label for what's being gated (e.g. `production-deploy`).     |\n| `run`                | no       | —                             | Command Decionis runs **only if authorized** (the enforcing path). |\n| `shell`              | no       | `bash`                        | Shell for `run` — `bash` or `sh`.                                  |\n| `payload`            | no       | _built from workflow context_ | JSON object describing the action being gated.                     |\n| `fail-on`            | no       | `block`                       | `block` / `escalate` / `block_or_escalate` / `never`.              |\n| `mode`               | no       | `enforce`                     | `enforce` or `shadow`. Shadow never fails the step.                |\n| `comment-pr`         | no       | `false`                       | Post (and update in place) the verdict as a PR comment.            |\n| `show-attribution`   | no       | `true`                        | Include the \"Governed by Decionis\" footer on the PR comment.       |\n| `api-base-url`       | no       | `https://api.decionis.com`    | Override for staging / self-host.                                  |\n| `site-base-url`      | no       | `https://decionis.com`        | Override for staging / self-host.                                  |\n| `request-timeout-ms` | no       | `20000`                       | Timeout for the evaluate-decision call.                            |\n\n## Outputs\n\n| Output           | Description                                                                 |\n| ---------------- | --------------------------------------------------------------------------- |\n| `decision`       | `allow` / `block` / `escalate` / `restrain`                                 |\n| `dossier-id`     | Signed Decision Dossier id for this evaluation.                             |\n| `verify-url`     | Public verify URL (`?sig=` so unfurls render the verdict OG card).          |\n| `policy-version` | Policy version (string) that produced the verdict.                          |\n| `reason-code`    | Stable reason code (string), if returned.                                   |\n| `badge-markdown` | Ready-to-paste \"Governed by Decionis\" badge linking to the live verify URL. |\n| `executed`       | `true` if a `run` command was authorized and executed, `false` if blocked.  |\n\n## Permissions\n\nDefault (`contents: read`) is enough. To enable `comment-pr: 'true'`:\n\n```yaml\npermissions:\n  contents: read\n  pull-requests: write\n```\n\n## How it works\n\nThe action calls `POST /v1/protocol/evaluate-decision` with the action label + payload (or a payload built from the workflow context), and returns the signed verdict. Inputs are echoed into the dossier so you can audit exactly what produced it. `shadow` mode **never** fails the step; a non-200 from the API fails the step with the status — no silent green builds.\n\n---\n\n\u003csub\u003eBuilt by [Decionis](https://decionis.com?source=github_action_readme) · [Quickstart](https://decionis.com/quickstart?source=github_action) · [Dossier example](https://decionis.com/dossier-example?source=github_action) · MIT licensed\u003c/sub\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdecionis%2Fgovern","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdecionis%2Fgovern","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdecionis%2Fgovern/lists"}