GitHub Actions evaluator

A pipeline gate. It asks Evaluate whether this service and commit may ship. It is not the emit step. Use two steps in the same workflow. Do not combine mode: emit and mode: check in one step.

Package: Evitrus/actions/export@v1 with mode: check. The root evitrus/action@v1 alias also understands mode.

Requirements

• A tenant API key with the evaluate scope
• The ingest scope as well, if a deny should be stored as deploy.blocked
• The service name and target environment for the ship you are gating

Install guide

Store the key as EVITRUS_EVAL_KEY (or reuse a key that has both scopes).

- name: Record build evidence
  uses: Evitrus/actions/export@v1
  with:
    api-key: ${{ secrets.EVITRUS_KEY }}
    ingest-url: https://api.evitrus.io/ingest
    service: payments-api
    type: build.artifact.published
    image: ghcr.io/acme/payments-api@${{ steps.build.outputs.digest }}

- name: Evaluate before ship
  uses: Evitrus/actions/export@v1
  with:
    mode: check
    api-key: ${{ secrets.EVITRUS_EVAL_KEY }}
    service: payments-api
    environment: prod
    evaluate-url: https://api.evitrus.io/compliance/evaluate

commit defaults to GITHUB_SHA. environment is sent to Evaluate so an open break-glass window for that service and environment can allow the ship. Omit it and the check step uses prod. Set staging (or similar) for non-prod gates.

wait-seconds polls Evaluate while evidence is still landing. poll-seconds is the interval (default 15).

The emit step is the GitHub Actions exporter. The two steps scale and fail independently.

How it enforces

The check step calls POST /compliance/evaluate. A deny fails the job. If Evaluate cannot be reached, the step succeeds and the ship proceeds.

Evaluate outcome	Step	Evidence
pass / overridden / breakglass / na	success	none extra
fail (HTTP 409)	fails the job	deploy.blocked when the key has ingest
5xx / timeout / network	fail-open (step succeeds)	none
Missing evidence the control needs	na — does not block	coverage gap on the Change

Pack-on includes this gate unless the tenant disables enforcement in the product. na does not block.