Govern any coding agent's PR with the Umbra admission pipeline and attach a signed receipt.
Usage
name: Umbra Admission
on:
pull_request:
permissions:
contents: read
pull-requests: write
jobs:
admit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
with:
ref: ${{ github.event.pull_request.head.sha }}
fetch-depth: 0
- uses: bkd-dotcom/umbra-action@v1
with:
min-authority: "1"
signing-key: ${{ secrets.UMBRA_SIGNING_KEY }}
Runs every PR — from Claude Code, Codex, Cursor, Copilot, Devin, or a human — through the umbra-core (https://github.com/bkd-dotcom/umbra-core) admission pipeline: executable contract → layered prompt-injection quarantine → required checks (sandboxed on Linux) → independent verifier → earned authority (0/1/2) → Ed25519-signed receipt. Posts the verdict as a PR comment, uploads the signed receipt, and fails the check below the required authority. auto_merge is always false — a human merges.