What's New
Proof Artifact
Every PR check now generates agentmesh-proof.json — a machine-readable JSON artifact with per-commit provenance, policy configuration, and an evidence fingerprint (SHA256). Uploaded automatically via actions/upload-artifact@v4 with 90-day retention.
Policy Profiles
Named presets for common enforcement levels:
| Profile | require-trailers |
verify-witness |
require-witness |
|---|---|---|---|
baseline |
false | false | false |
strict |
true | true | false |
enterprise |
true | true | true |
Explicit flag values always override the profile.
License Transition
Apache-2.0 for all current and future development. The v1 tag and prior releases remain under their original terms.
Migration from v1
# Before
- uses: Haserjian/agentmesh-action@v1
# After
- uses: Haserjian/agentmesh-action@v2
with:
policy-profile: strict # optionalAll v1 inputs remain supported. New inputs (policy-profile, upload-proof) default to backward-compatible values.
Tests
7/7 tests passing (3 existing + 4 new covering proof artifact, fingerprint stability, profile resolution, and override precedence).