monikadvorackova/GovAI artifact-bound compliance gate
Posts CI-produced evidence artefacts to the GovAI ledger, verifies digest continuity via events_content_sha256, and fails CI unless hosted evaluation is VALID (production semantics).
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- Apache 2.0
Pinned Snippet
uses: monikadvorackova/aigov-core@12cf56164844d90e2d17663bb51c888b4c722cd2 # v1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| run_id | Evidence run id (same identifier as CI evidence artefacts: <artifacts_path>/<run_id>.json). | yes | — |
| artifacts_path | Directory containing CI evidence artefacts: evidence_digest_manifest.json and <run_id>.json (typically downloaded from CI upload-artifact steps). | yes | — |
| base_url | GovAI audit service base URL | yes | — |
| api_key | GovAI API key | yes | — |
| project | Optional project label (X-GovAI-Project, metadata only). Default: github-actions. | no | github-actions |
| require_export | When true, pass --require-export to verify-evidence-pack (fail if /api/export cross-check is unavailable). | no | true |
Outputs
no outputs