jeremylongshore/Intent Rollout Gate

Consume an Evidence Bundle (in-toto Statement v1 rows under predicateType https://evals.intentsolutions.io/gate-result/v1) and a rollout policy, and decide allow / block (fail closed). All decision logic is delegated to the published @intentsolutions/rollout-gate package — this action is the thin GitHub Actions shell. Part of the Intent Eval Platform.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 8, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: jeremylongshore/intent-rollout-gate@1c2e13029bf7088870df16037a9969fe1c4d9296 # v0.3.2

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
bundle-path	Filesystem path to the Evidence Bundle JSON file. Accepts both wire forms: the v2 plain array of in-toto Statements (kernel EvidenceBundlePayload) and the v1 legacy container {"bundle_format":"json-array","rows":[...]}. A missing, unreadable, or invalid-JSON file blocks (fail closed).	yes	—
policy-path	Path to the rollout policy JSON document ({"required_gates":[...], "forbid_decisions":[...], "advisory_blocks":bool, "allow_unknown_gates":bool} — see @intentsolutions/rollout-gate parsePolicy). Exactly one of policy-path or policy-json is required; both or neither blocks (fail closed). Parsing tests/TESTING.md directly stays deferred per DR-002 § 5.	no	""
policy-json	Inline rollout policy as a JSON string. Exactly one of policy-path or policy-json is required; both or neither blocks (fail closed).	no	""
fail-on-block	If 'true' (default), a block decision fails the job. If 'false', the action succeeds and only reports outputs — observability rollouts ahead of enforcement. Any value other than an explicit 'false' fails on block (fail closed).	no	true
policy-file	DEPRECATED alias for policy-path (v0.0.x input name, kept additive per Evidence Bundle SPEC R18). Note the v0.0.x default of tests/TESTING.md is GONE — TESTING.md parsing is deferred per DR-002 § 5 and a markdown file would fail policy parsing anyway (fail closed).	no	""
predicate-uri	Reserved (v0.0.x input, kept additive). v0.3.0 evaluates only the stable v1 URI https://evals.intentsolutions.io/gate-result/v1; any other value blocks (fail closed).	no	https://evals.intentsolutions.io/gate-result/v1
rekor-url	Reserved (v0.0.x input, kept additive). Transparency-log anchoring of the rollout-decision row is NOT implemented at v0.3.0; no Rekor push ever happens (the DNSSEC + CAA pre-condition per DR-004 § 6.1 gates that milestone). Input is currently ignored.	no	https://rekor.sigstore.dev
cosign-key	Reserved (v0.0.x input, kept additive). Decision-row signing is NOT implemented at v0.3.0; setting this emits a warning and performs no signing.	no	""
dry-run	DEPRECATED alias for fail-on-block: 'false' (v0.0.x input, kept additive). If 'true', evaluate and report but never fail the job.	no	false

Outputs

name	description
decision	'allow' or 'block' — verbatim from @intentsolutions/rollout-gate decide() (allow corresponds to ship, block to no-ship in the pre-implementation v0.0.x vocabulary). The v0.0.x 'not-implemented' value is retired.
reasons	JSON array string of every blocking reason (empty array exactly when decision is 'allow').
summary	Markdown summary of the decision: required-gate table, blocking rows, and the flat reason list. Also written to the job step summary.
signed-decision-row-path	Reserved — always empty at v0.3.0. Populated once decision-row signing (predicateType https://evals.intentsolutions.io/rollout-decision/v1) lands behind the DNSSEC + CAA pre-condition (DR-002 § 6.3).