Documentation

The CI check

Nothing is checked until this step runs. It compares the push with every intent it covers, on a machine the agent doesn’t run on.

name: GateBolt
on: [push]
jobs:
  provenance:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - run: npx @gatebolt/cli ci
        env:
          GATEBOLT_KEY: ${{ secrets.GATEBOLT_KEY }}
          GITHUB_TOKEN: ${{ github.token }}

• GitHub Actions is the only CI supported today.
• Use a CI key. It can only check; it cannot declare, so a leaked secret cannot write the intent it checks against.
• fetch-depth: 0 is required. The step refuses to run on a shallow clone.
• It reports and stays green unless you pass --fail-on low|medium|high|critical. A missing .gatebolt file is an error.
• With GITHUB_TOKEN it posts the result as one comment on the pull request.
• Pull requests from forks are skipped. GitHub gives them no secrets.