decionis/Decionis Action Gate

Runtime guardrail for autonomous AI agents & CI/CD — gate deploys, migrations & infra before they run, with signed proof.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 5, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: decionis/govern@2a3f0e684eaeeb1a309707b2b4ac08f83571c9af # v1.9.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
api-key	Decionis API key with `protocol:evaluate` scope. Pass as a workflow secret (`secrets.DECIONIS_API_KEY`). Never hard-code.	yes	—
org-id	Decionis org id (UUID) the decision belongs to.	yes	—
workflow-key	The workflow key registered in Decionis policy (e.g. `github_deploy_approval`). Drives which policy bundle is evaluated.	yes	—
action	Short label for the action being gated (e.g. `production-deploy`, `terraform-apply`, `ai-generated-pr`). Recorded on the dossier and shown in the verdict. Optional — purely for readability and reporting.	no	""
run	Shell command(s) that Decionis executes ONLY if it authorizes the action. The gated command runs through Decionis, so it executes on `allow` and is held on block/escalate (the step then fails). In shadow mode the command always runs while Decionis records the verdict.	no	""
shell	Shell used to run the `run` command. `bash` (default) or `sh`.	no	bash
request-grant	When `true` and the verdict authorizes the action, request a short-lived, single-use signed Execution Grant. It is exposed as the `execution-grant` output and injected into the `run` command's environment as `DECIONIS_EXECUTION_GRANT` so the deploy target can verify the authorization before acting.	no	false
grant-audience	Optional audience to bind the Execution Grant to (e.g. a target/env id like `prod-us-east`). The target verifies the grant was minted for it.	no	""
payload	JSON string describing the action being gated. Free-form fields per the workflow's policy schema (resource, actor, requested change, etc.). When omitted, a minimal payload is built from the workflow context (repo / ref / sha / event / actor / run id).	no	""
fail-on	Which verdicts cause this Action to fail the step. One of: `block` (default), `escalate`, `block_or_escalate`, `never`.	no	block
mode	`enforce` (default) or `shadow`. In shadow mode the Action records a verdict but never fails the step — useful for week-one rollouts. Shadow is also speculative: a `run` command starts immediately while the verdict resolves in the background, so the gate adds ~zero latency; evaluation failures (API errors, missing credentials) become notices, never step failures, and the step's exit code is exactly the command's.	no	enforce
comment-pr	When `true` and this run was triggered by a pull_request event, post (and update in place) the verdict as a PR comment with the dossier verify URL. Requires `pull-requests: write` permission on the workflow.	no	false
show-attribution	When `true` (default), the PR comment includes a small "Governed by Decionis" footer linking back to the action. Set `false` for a bare comment with no attribution.	no	true
api-base-url	Override the Decionis API base URL (for staging / self-host).	no	https://api.decionis.com
site-base-url	Override the public site base URL (for staging / self-host).	no	https://decionis.com
request-timeout-ms	Timeout for the evaluate-decision call, in milliseconds. Also budgets the post-command grace window for background notarization (capped at 10s).	no	20000
policy-file	Path (relative to the repo root) to a `DECIONIS_POLICY.md` policy file to inject into the decision. The file is read, content-hashed, and carried with the evaluation so the gate governs against — and the Decision Dossier records — your repo's policy. The sha256 is the version handle: change the file, get a new recorded revision. Set to an empty string to disable. A missing or unreadable file never fails the gate. A YAML policy file is also accepted — with the default path, `DECIONIS_POLICY.yaml` / `.yml` siblings are tried too.	no	DECIONIS_POLICY.md
policy-enforce	When `true`, the structured ```decionis``` rules block in the policy file is compiled into an ACTIVE enforced policy bundle for this org + workflow-key (true GitOps — committing the file changes enforcement, no dashboard). Idempotent by content hash. Default `false` (the file is recorded/versioned but not auto-enforcing). Prose without a rules block is never enforced.	no	false
local-eval	Local policy engine mode. `auto` (default): the ```decionis``` rules block in your policy file is evaluated in-process (microseconds); a deterministic allow/block from an explicitly matched rule acts immediately and the API call becomes an async notarization off the critical path — the signed dossier, verify URL, and badge still arrive, and a disagreeing API verdict sets `verdict-mismatch=true` with a warning. `strict`: deterministic local verdicts skip the network entirely (offline-capable; no dossier for those runs). `off`: v1.8 behavior — every verdict comes from the blocking API call. Escalate/restrain matches, no-match, unknown operators, malformed or YAML policies, and rules that depend on server-side state ALWAYS fall back to the API. `request-grant: true` always forces the blocking path.	no	auto

Outputs

name	description
decision	Verdict — one of: allow, block, escalate, restrain, review (the API's REVIEW outcome). API outcomes are normalized (APPROVE→allow, REJECT→block, REQUIRE_REVIEW→review).
decision-source	Where the acting verdict came from — `local` (deterministic rule from the repo's policy file, evaluated in-process) or `api`.
verdict-mismatch	"true" when a deterministic local verdict acted but the notarizing API call returned a different verdict (org-level policy may add rules). Emitted with a `::warning::` — the signed dossier records the API verdict.
dossier-id	Signed Decision Dossier id for this evaluation.
verify-url	Public verify URL with `?sig=` — opens the branded verification page; unfurls with the OG card in Slack / Teams / LinkedIn / X.
policy-version	Policy version (string) that produced the verdict.
policy-sha256	sha256 of the injected `DECIONIS_POLICY.md` content (empty if no policy file was found). The content-addressed version handle for the repo policy.
policy-path	Repo-relative path of the injected policy file, if any.
policy-enforced	"true" when `policy-enforce` was set and a policy file was found (the file's rules block is published as the active enforced bundle).
reason-code	Stable reason code (string) for the verdict, if returned.
badge-markdown	Ready-to-paste Markdown for a "Governed by Decionis" badge linking to the signed verify URL — drop it in a README or release notes. When a policy file is present the link is pinned to its sha256 (`&policy=sha256:…`), so the badge cryptographically binds the decision to the repo policy state.
executed	`true` if a `run` command was authorized and executed, `false` if it was blocked. Empty when no `run` command was supplied.
execution-grant	The short-lived, single-use signed Execution Grant (EdDSA JWT), when `request-grant: true` and the verdict authorizes. A target verifies it against the public JWKS before acting. Empty otherwise.
grant-expires-at	ISO timestamp when the Execution Grant expires.