TrigGuard
TRIGGUARD GITHUB ACTIONS
Open Console

CI INTEGRATION

← Documentation

GitHub Actions

Add authorization before deployments. Gate irreversible CI steps with TrigGuard-AI/authorize@v1, then deploy only on PERMIT.

Install the action

Marketplace action · gateway call · receipt · runner verify

Use the published Marketplace action. It calls the TrigGuard gateway, returns a receipt, and verifies the signature on the runner.

- name: Authorize deployment
  id: authorize
  uses: TrigGuard-AI/authorize@v1
  with:
    surface: deploy.release
    gateway_url: https://api.trigguardai.com
    authToken: ${{ secrets.TRIGGUARD_API_KEY }}
    repository: ${{ github.repository }}
    branch: ${{ github.ref_name }}

Prefer GCP Workload Identity Federation in production (workload_identity_provider + service_account, with permissions: id-token: write). API key is fine for a pilot.

Configure the surface

Gate the irreversible action, not a generic CI label.

surface is the irreversible action you are gating. Match it to your policy.

  • deploy.release - production deploy / release
  • database.migrate - schema migration
  • infra.apply - infrastructure apply

Branch on the result

Deploy only on PERMIT. Enforce mode fails closed otherwise.

Wire the deploy step explicitly so a non-permit path cannot continue by accident.

See the decision model →

Deploy only on PERMIT

Gate the deploy step on the authorize output.

- name: Deploy
  if: steps.authorize.outputs.decision == 'PERMIT'
  run: npm run deploy

Minimal workflow

Copy into .github/workflows/trigguard-deploy.yml.

Full golden path - copy the minimal authorize workflow below.

name: Deploy

on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Authorize deployment
        id: authorize
        uses: TrigGuard-AI/authorize@v1
        with:
          surface: deploy.release
          gateway_url: https://api.trigguardai.com
          authToken: ${{ secrets.TRIGGUARD_API_KEY }}
          repository: ${{ github.repository }}
          branch: ${{ github.ref_name }}

      - name: Deploy
        if: steps.authorize.outputs.decision == 'PERMIT'
        run: npm run deploy