https://github.com/mizcausevic-dev/evidence-bundle-fleet-summary-action
GitHub Action wrapping evidence-bundle-fleet-summary. Flags bundle-expired, unsigned-regulated-bundle, cross-bundle-hash-collision, oversized-bundle. PR comment + fail-on-high. Completes the per-protocol fleet-summary action quartet.
https://github.com/mizcausevic-dev/evidence-bundle-fleet-summary-action
actions ai-governance audit compliance evidence fleet github-action kinetic-gain-suite provenance typescript
Last synced: 25 days ago
JSON representation
GitHub Action wrapping evidence-bundle-fleet-summary. Flags bundle-expired, unsigned-regulated-bundle, cross-bundle-hash-collision, oversized-bundle. PR comment + fail-on-high. Completes the per-protocol fleet-summary action quartet.
- Host: GitHub
- URL: https://github.com/mizcausevic-dev/evidence-bundle-fleet-summary-action
- Owner: mizcausevic-dev
- License: agpl-3.0
- Created: 2026-05-27T03:41:17.000Z (29 days ago)
- Default Branch: main
- Last Pushed: 2026-05-28T00:50:07.000Z (29 days ago)
- Last Synced: 2026-05-28T02:22:47.962Z (28 days ago)
- Topics: actions, ai-governance, audit, compliance, evidence, fleet, github-action, kinetic-gain-suite, provenance, typescript
- Language: TypeScript
- Homepage: https://suite.kineticgain.com/
- Size: 245 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 7
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md
Awesome Lists containing this project
README
# evidence-bundle-fleet-summary-action
[](https://github.com/mizcausevic-dev/evidence-bundle-fleet-summary-action/actions/workflows/ci.yml)
[](LICENSE)
GitHub Action that walks a directory of **evidence-bundle** `manifest.json` files, counts by purpose, surfaces governance gaps, posts a Markdown summary as a PR comment, and **fails the build** when any high-severity finding is present.
Wraps [`evidence-bundle-fleet-summary`](https://github.com/mizcausevic-dev/evidence-bundle-fleet-summary) — same finding logic, vendored into the action for self-contained execution.
**Fourth in the action family — completes the per-protocol fleet-summary action quartet:**
- [`agent-card-fleet-summary-action`](https://github.com/mizcausevic-dev/agent-card-fleet-summary-action) — A2A AgentCards
- [`mcp-tool-card-fleet-summary-action`](https://github.com/mizcausevic-dev/mcp-tool-card-fleet-summary-action) — MCP Tool Cards
- [`prompt-provenance-fleet-summary-action`](https://github.com/mizcausevic-dev/prompt-provenance-fleet-summary-action) — prompt-provenance docs
- **`evidence-bundle-fleet-summary-action`** — evidence bundles
Part of the [Kinetic Gain Suite](https://suite.kineticgain.com/).
---
## Usage
```yaml
name: Evidence bundle governance
on:
pull_request:
paths: ["bundles/**"]
jobs:
fleet-summary:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: mizcausevic-dev/evidence-bundle-fleet-summary-action@v0.1-shipped
with:
bundles-dir: bundles/
oversized-mb: 100 # optional, default 100
fail-on-high: true
```
## Inputs
| input | required | default | description |
|---|---|---|---|
| `bundles-dir` | ✓ | — | Directory containing `manifest.json` files (one per bundle). |
| `comment-on-pr` | | `auto` | `auto` posts only on `pull_request` events; `true`/`false` force the behavior. |
| `fail-on-high` | | `true` | Fail the run when any high-severity finding is present. |
| `oversized-mb` | | `100` | Bundles larger than this many MB trigger the `oversized-bundle` finding. |
| `github-token` | | `${{ github.token }}` | Token used to post the PR comment. |
## Outputs
| output | description |
|---|---|
| `total-bundles` | Number of bundles analyzed. |
| `high-findings` | Count of high-severity findings. |
| `signed-bundles` | Number of bundles with a signature block. |
| `expired-bundles` | Number of bundles past their `expires_at`. |
## What it flags
| Code | Severity | Rule |
|---|---|---|
| `bundle-expired` | 🔴 | `bundle.expires_at` is in the past. |
| `unsigned-regulated-bundle` | 🔴 | `bundle.purpose` ∈ {audit-evidence, compliance-disclosure, regulatory-submission} but no `signature` block. |
| `cross-bundle-hash-collision` | 🔴 | Same `items[].sha256` appears in 2+ different bundles. |
| `no-items` | 🔴 | Bundle declares no `items[]`. |
| `oversized-bundle` | 🟠 | Total `items[].size_bytes` > threshold (default 100 MB). |
| `no-provenance` | 🟠 | No `provenance` block. |
| `no-relationships` | 🟡 | No `relationships[]` declared. |
| `no-labels` | ℹ️ | No `bundle.labels` declared. |
## Composes with
- [**`evidence-bundle-fleet-summary`**](https://github.com/mizcausevic-dev/evidence-bundle-fleet-summary) — the library this wraps.
- [**`evidence-bundle-spec`**](https://github.com/mizcausevic-dev/evidence-bundle-spec) — the schema this reads.
- [**`evidence-bundle-builder`**](https://github.com/mizcausevic-dev/evidence-bundle-builder) · [**`evidence-bundle-diff`**](https://github.com/mizcausevic-dev/evidence-bundle-diff) · [**`evidence-bundle-readme-generator`**](https://github.com/mizcausevic-dev/evidence-bundle-readme-generator) — full evidence-bundle tool family.
- [**`agent-card-fleet-summary-action`**](https://github.com/mizcausevic-dev/agent-card-fleet-summary-action) · [**`mcp-tool-card-fleet-summary-action`**](https://github.com/mizcausevic-dev/mcp-tool-card-fleet-summary-action) · [**`prompt-provenance-fleet-summary-action`**](https://github.com/mizcausevic-dev/prompt-provenance-fleet-summary-action) — sibling Actions across the per-protocol fleet-summary quartet.
## License
[AGPL-3.0-or-later](LICENSE)