octo-o-o-o/ProjectValueLab Dependency Gate

Assess newly added lockfile dependencies against the ProjectValueLab gate (GO / VALIDATE / DROP decision cards with evidence). Advisory by default.

Trust Signals

name	description	required	default
operation	assess (default): evaluate pull_request lockfile additions. reconcile: on a trusted branch ref, snapshot all supported lockfiles and POST /v1/gate/reconcile to backfill prior GitHub Action outcomes; reconciliation failures always fail the step.	no	assess
mode	advisory (default): decisions and runtime failures never fail the check (only misconfiguration does, e.g. wrong event type). block: fail the check on DROP decisions (must be enabled explicitly per repo; block-mode calls are recorded in the gate server audit log via X-PVL-Gate-Mode / X-PVL-Gate-Caller).	no	advisory
block-on	Which decisions fail the check in block mode: drop \| drop-and-validate	no	drop
on-error	What to do in block mode when an assessment errors (gate unreachable etc.): warn (default, does not fail) \| fail (fail closed).	no	warn
gate-url	ProjectValueLab base URL (or set PVL_GATE_URL env).	no	—
github-token	Token for PR comment + file reads (defaults to workflow token).	no	${{ github.token }}
max-assess	Max coordinates assessed per run (1-100).	no	30
comment	Post/update the sticky PR comment (true\|false).	no	true
comment-author	Login that owns the sticky comment (only comments by this author are updated; marker comments pre-placed by others are ignored). Default matches the workflow token identity.	no	github-actions[bot]

no outputs