Skip to content

Releases: Rul1an/assay-action

Release list

Assay Action v3.0.1: AI agent security gate for CI

Assay Action v3.0.1: AI agent security gate for CI Latest
Latest

Choose a tag to compare

View all tags
@Rul1an Rul1an released this 02 Jul 13:57
v3.0.1
f0c2125
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v3 is the current major: verify, lint, and diff evidence bundles from AI agent runs in CI, with coding-agent sandbox governance and in-toto/DSSE bundle attestation.

What v3 carries

  • sandbox-command: run a coding agent under assay sandbox and verify the resulting evidence bundle in the same job.
  • attest-key: in-toto/DSSE attestation over the bundle (assay evidence attest).
  • The v2.1 AI Agent Security feature set: compliance packs, BYOS push, artifact attestation, coverage badges, PR summaries, SARIF for code scanning.

v3.0.1 fixes

  • Authenticate the latest-release lookup and resolve the release before caching the CLI (#30, #31), removing rate-limit flakes on busy runners.

Breaking vs v2: the legacy marketplace mode/run inputs are not carried; pin Rul1an/assay-action@v2 if you depend on those. Migration notes in the action spec.

Pin the major: uses: Rul1an/assay-action@v3

Assets 2
Loading

Assay Action v2: Evidence Review in GitHub Actions

Assay Action v2: Evidence Review in GitHub Actions
Marketplace
Marketplace

Choose a tag to compare

View all tags
@Rul1an Rul1an released this 28 Jan 09:24
v2
f0c2125
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Assay Action v2

Paste one workflow, get reviewable Assay evidence artifacts in GitHub Actions.

The action is intentionally small: it verifies checked-in or generated Assay evidence bundles, writes a compact job summary, uploads a named reports artifact, and can publish SARIF to GitHub code scanning.

What Fails A PR

By default, a PR fails only after review surfaces are written:

  1. bundle verification fails; or
  2. findings meet the configured fail_on threshold, defaulting to error.

That ordering is deliberate: install -> run/capture -> verify/lint -> upload artifacts -> fail. Reviewers should still have the evidence when a run is red.

Review Surfaces

  • Job summary for the fast human read.
  • assay-reports-${{ github.run_id }} for downloadable evidence review.
  • SARIF for GitHub code scanning when enabled.
  • Baseline finding delta for what changed versus the cached base-branch baseline.

Start Here

Use the copyable workflow in the README:

https://github.com/Rul1an/assay-action#readme

Related proof page:

https://github.com/Rul1an/assay/blob/main/docs/notes/EVIDENCE-RECEIPTS-IN-ACTION.md

Boundary

No dashboard. No hosted service. No model-correctness claim. No upstream integration claim.

The action makes the observed evidence boundary reviewable in a GitHub-native shape.

Capability Diff Preview

The Marketplace-visible README on main also includes an experimental, scripts-only capability diff preview. It is not part of the stable @v2 action interface, not a PR gate, and not a production mode: diff.

Preview feedback is tracked here:

#11

Loading