ondco/OSuite Governed Action
Gate GitHub Actions with OSuite governed action records, approval checks, and replayable proof.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| osuite-api-key | OSuite API key. Store it as a GitHub Actions secret. | no | — |
| osuite-base-url | OSuite Studio base URL. | no | https://studio.osuite.ai |
| agent-id | OSuite agent/runtime identifier for this GitHub Actions runner. | no | github-actions-runtime |
| agent-name | Human-readable OSuite agent/runtime name. | no | GitHub Actions |
| action-type | Governed action type sent to OSuite, for example deploy, build, test, security, or release. | no | deploy |
| target | System or environment the workflow intends to touch. Defaults to the repository and ref. | no | — |
| declared-goal | Plain-language goal for the governed action. | no | — |
| risk-score | Optional caller-provided raw risk score from 0 to 100. OSuite may override it with server-side scoring. | no | — |
| reversible | Whether the proposed action is reversible. | no | false |
| systems-touched | Optional comma-separated systems touched by the workflow. | no | — |
| metadata | Optional JSON object included in the OSuite workflow context. | no | — |
| policy-profile-id | Optional OSuite policy profile id to bind this workflow to. | no | — |
| policy-posture | Optional JSON object with policy posture overrides. | no | — |
| decision-scoring-profile-id | Optional OSuite decision scoring profile id. | no | — |
| mode | enforce blocks or waits according to OSuite decisions; observe records decisions without failing the workflow. | no | enforce |
| wait-for-approval | Poll OSuite when approval is required. | no | true |
| approval-timeout-seconds | Maximum time to wait for OSuite approval. | no | 900 |
| approval-poll-seconds | Poll interval while waiting for OSuite approval. | no | 10 |
| fail-on-block | Fail the workflow when OSuite blocks the action. | no | true |
| fail-on-require-approval | Fail the workflow if approval is required and not granted before the timeout. | no | true |
| dry-run | Validate payload generation without calling OSuite. | no | false |
Outputs
| name | description |
|---|---|
| decision | OSuite decision, such as allow, warn, require_approval, simulate_first, or block. |
| status | OSuite action status. |
| action-id | OSuite governed action id. |
| risk-score | Server-side OSuite risk score when available. |
| action-hash | Deterministic hash over the GitHub workflow action envelope. |
| replay-url | OSuite replay URL for the governed action. |
| proof-url | OSuite proof bundle URL for the governed action. |