rafineriaai/AOS Workflow Gate

Pre-merge control assurance for the exact PR commit. Detect a control that is missing, stale, produced by the wrong app, or modified by the same PR; get a PASS/WARN/BLOCK verdict, one next action, and replayable evidence. Read-only and advisory by default. Records carry UNSIGNED_NOT_OFFICIAL verification status; no production, compliance, signing, SLSA, or security-audit claim is made.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 11, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: rafineriaai/aos-workflow-gate@b12376dc7c0f3d89d905c4e96d7588469209f2e0 # v0.29.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
input	Path to the signal bundle JSON. Leave empty for Self-Test Mode (zero-config): the completed check runs of the current commit are collected from the GitHub API and gated with an explicit generated advisory policy. Self-Test Mode needs no checkout.	no	""
policy	Path to the policy JSON or YAML. With an explicit input bundle it defaults to the bundled advisory default policy; in zero-config mode it defaults to the generated advisory policy.	no	""
required-checks	Self-Test Mode only. Comma- or newline-separated check run names to mark required in the generated policy; a missing or failed required check makes the verdict BLOCK.	no	""
sarif	Self-Test Mode only. Newline-separated paths to existing SARIF 2.1.0 files. AOS reads the files locally and never runs the scanner; checkout and SARIF generation must happen in earlier steps.	no	""
wait-for-checks	Self-Test Mode only. Polling budget for required controls. With automatic GitHub requirement discovery, "0" uses the built-in 120-second stabilization window; a positive value overrides it. With explicit required-checks, "0" means no polling. A wait that ends incomplete fails closed and is recorded in collection evidence.	no	0
out	Path where the decision record JSON is written.	no	gate-decision.json
mode	"advisory" (default) reports the verdict without failing the job; "enforce" makes a BLOCK verdict fail the step.	no	advisory
policy-pack	Bundled starter policy by name (minimal-pr-gate, release-candidate, agent-review-advisory, evidence-integrity). Ignored when "policy" is set. See docs/POLICY_PACKS.md.	no	""
upload-artifact	Upload the decision record, the .aos-gate/ evidence files, and the static evidence.html as the "aos-gate-evidence" artifact (runs even when an enforced BLOCK fails the evaluate step). Enabled by default so first runs keep their evidence; set "false" to skip. Artifacts expire per repository settings - attach the files to a release for permanence.	no	true
enforce	Deprecated alias: "true" behaves like mode "enforce".	no	false

Outputs

name	description
verdict	The gate verdict (PASS, WARN, or BLOCK).
record	Path to the decision record JSON.
record-digest	Self-digest of the decision record.
can-block	Whether this evaluation, as configured, could fail the job on a BLOCK verdict ("true"/"false").
diagnosis	One line - the verdict and what AOS found.
next-action	The single dominant next step for the operator.
decision-contrast	Relationship to GitHub's required-check baseline, such as github_already_blocks or aos_policy_gap.
incremental-gap	Whether this verdict adds a policy/evidence gap beyond a clear GitHub required-check baseline ("true"/"false").
required-total	Number of required sources in the policy.
required-successful	Required sources that concluded success.
required-missing	Required sources absent from the bundle (state missing).
required-pending	Required sources still running when collected.
required-unverifiable	Required sources that could not be shown to satisfy their requirement (app-bound identity or unreadable stream).
required-failed	Required sources that concluded non-success.
advisory-warnings	Advisory warnings in the decision.