Release list

APort Repository Guard v1.0.7 Latest

Latest

github-actions released this 07 Sep 02:59

v1.0.7

068991c

APort Repository Guard v1.0.7

Released from aporthq/policy-verify-action@068991c6ba713de0ed72e725703c5213148eaf80.

Changes

Deploy Policy Verify Action from aporthq/agent-passport@3f82412 (ed35f14)

Use this release with:

uses: aporthq/policy-verify-action@v1

Assets 2

APort Repository Guard v1.0.6

github-actions released this 04 Sep 20:54

v1.0.6

6f9fe09

APort Repository Guard v1.0.6

Released from aporthq/policy-verify-action@6f9fe09f008e75bb72112c83e2751cd4c18a513a.

Changes

Deploy Policy Verify Action from aporthq/agent-passport@68e4c21 (2a35fd9)

Use this release with:

uses: aporthq/policy-verify-action@v1

Assets 2

APort Repository Guard v1.0.5

github-actions released this 02 Sep 01:55

v1.0.5

8aaf8c2

APort Repository Guard v1.0.5

Released from aporthq/policy-verify-action@8aaf8c26a1aa6badb7ace18f093cc493ed6b574f.

Changes

Deploy Policy Verify Action from aporthq/agent-passport@53ed35f (e0a2730)

Use this release with:

uses: aporthq/policy-verify-action@v1

Assets 2

APort Repository Guard v1.0.4

github-actions released this 01 Sep 17:34

v1.0.4

37d5ad5

APort Repository Guard v1.0.4

Released from aporthq/policy-verify-action@37d5ad52753ae1c242b773e2307656d253ef4b58.

Changes

Deploy Policy Verify Action from aporthq/agent-passport@e21150d (23486dc)

Use this release with:

uses: aporthq/policy-verify-action@v1

Assets 2

APort Repository Guard v1.0.3

github-actions released this 01 Sep 17:12

v1.0.3

b027723

APort Repository Guard v1.0.3

Released from aporthq/policy-verify-action@b02772335e1aa2c319e5ca9f3efb6fb4ef675fd7.

Changes

Deploy Policy Verify Action from aporthq/agent-passport@ac8e5c0 (eea8aff)
Deploy Policy Verify Action from aporthq/agent-passport@da1e979 (4f4ef3c)
Deploy Policy Verify Action from aporthq/agent-passport@6d265ee (3cc0c6c)

Use this release with:

uses: aporthq/policy-verify-action@v1

Assets 2

APort Repository Guard v1.0.2

Marketplace

uchibeke released this 23 Aug 00:28

v1.0.2

5af6c62

This release updates aporthq/policy-verify-action from the old API-key PR policy check into the new APort Repository Guard.

What Changed

Adds default auto mode: the Action requests GitHub OIDC, creates or reuses a hosted repository/workflow-scoped OAP passport, and calls APort Verify for code.repository.merge.v1.
Adds safe fallback behavior: when hosted verification is unavailable in auto, the Action falls back to clearly labelled evidence-only reporting instead of pretending hosted verification succeeded.
Adds explicit hosted, local-json, and evidence-only modes.
Adds hosted decision signature verification against APort OAP JWKS before using a hosted decision.
Adds report-only repository provenance for PRs: actor classification, APort commit trailer recognition, protected-path findings, workflow write-permission escalation, and pull_request_target detection.
Adds trusted base-branch .aport/policy.yaml / .aport/policy.yml support for Action-side evidence configuration.
Removes the requirement for a user-managed APort account, passport ID, API key, secret, or PR comments in the default free path.

Usage

name: APort Repository Guard
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled, review_requested, review_request_removed]
  pull_request_review:
    types: [submitted, dismissed]

permissions:
  id-token: write
  contents: read
  pull-requests: read

jobs:
  aport:
    runs-on: ubuntu-latest
    steps:
      - uses: aporthq/policy-verify-action@v1.0.2

Notes

Default mode exits 0 and writes findings to $GITHUB_STEP_SUMMARY.
Explicit hosted mode fails if signed hosted verification cannot complete or returns deny.
local-json mode reads a trusted OAP passport from the base workflow ref and posts it to APort Verify without hosted decision persistence.
evidence-only mode makes no APort network calls.

Validation

npm test
npm run validate
injected-signature scan clean for known obfuscation markers

Assets 2

APort Policy Verification Action v1.0.1

Marketplace

uchibeke released this 09 Oct 23:42

v1.0.1

a9bb7dd

🚀 Production-Ready Release with Critical Fixes

We're excited to announce v1.0.1 of the APort Policy Verification GitHub Action! This release includes critical fixes, comprehensive improvements, and production-ready enhancements that make the action enterprise-grade and ready for investor demonstrations.

✨ What's New in v1.0.1

🔧 Critical Fixes

API Response Parsing - Fixed response structure parsing from .data.decision.allow to .decision.allow
Joi Schema Alignment - Updated schema to match policy evaluator expectations with proper action field support
Context Mapping - Corrected GitHub context to APort policy context mapping for all required fields
Error Handling - Enhanced error handling and validation throughout the action

🛡️ Enhanced Security & Reliability

Input Validation - Comprehensive validation for agent ID and policy pack formats
Retry Logic - Built-in retry mechanism with exponential backoff for API reliability
Authentication - Full API key authentication support with secure credential handling
Timeout Control - Configurable request timeouts for better performance

📊 Improved User Experience

Rich PR Comments - Enhanced PR comments with detailed policy information and next steps
Better Logging - Comprehensive logging for troubleshooting and debugging
Flexible Configuration - Support for multiple GitHub events and manual dispatch
Comprehensive Documentation - Complete setup guide with examples and troubleshooting

🔧 Technical Improvements

API Integration

✅ Fixed response parsing to match actual API structure
✅ Added support for all required context fields
✅ Enhanced error handling for API failures
✅ Improved retry logic with exponential backoff

Schema Validation

✅ Updated Joi schema to include action field
✅ Aligned validation with policy evaluator requirements
✅ Added support for all repository operation fields
✅ Fixed field mapping between GitHub and APort contexts

Context Mapping

GitHub Context	APort Context	Status
`github.repository`	`repository`	✅ Fixed
`github.event.pull_request.base.ref`	`branch`	✅ Fixed
`github.actor`	`github_actor`	✅ Fixed
`github.app`	`github_app`	✅ Fixed
Computed diff stats	`files_changed`, `lines_added`	✅ Fixed
PR size calculation	`pr_size_kb`	✅ Fixed
Changed file paths	`file_paths`	✅ Fixed
Review requirements	`requires_review`	✅ Fixed
PR labels	`labels`	✅ Fixed
Review count	`reviews`	✅ Fixed
Draft status	`is_draft`	✅ Fixed
Mergeable status	`is_mergeable`	✅ Fixed
PR title	`title`	✅ Fixed
PR description	`description`	✅ Fixed

📋 Configuration Updates

New Input Parameters

Parameter	Description	Required	Default
`api-key`	APort API key for authenticated requests	❌	-
`timeout-seconds`	Request timeout in seconds	❌	`30`

Enhanced Input Validation

✅ Agent ID format validation (ap_xxxxxxxxx)
✅ Policy pack format validation (category.action.type.v1)
✅ API endpoint validation
✅ Timeout value validation

🧪 Testing & Quality Assurance

Comprehensive Test Suite

✅ Mock API server for local testing
✅ Direct API testing scripts

Quality Metrics

✅ 100/100 Production Ready - All validations passed
✅ Zero Linting Errors - Clean, production-ready code
✅ Complete Documentation - Comprehensive setup and usage guides
✅ Security Reviewed - All security best practices implemented

📚 Documentation Improvements

Enhanced README

✅ Complete setup guide with step-by-step instructions
✅ Comprehensive input/output documentation
✅ Troubleshooting section with common issues
✅ Security best practices and configuration guide
✅ Multiple usage examples from basic to advanced

Example Files

✅ Basic to advanced configurations
✅ Environment-specific setups
✅ Integration with other actions
✅ Manual dispatch examples

🚀 Quick Start (Updated)

1. Basic Usage

name: APort Policy Check
on: [pull_request]

jobs:
  policy-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aporthq/policy-verify-action@v1.0.1
        with:
          agent-id: ${{ secrets.APORT_AGENT_ID }}
          policy-pack: 'code.repository.merge.v1'

2. Advanced Configuration

name: Advanced APort Policy Check
on:
  pull_request:
    types: [opened, synchronize, labeled, ready_for_review]
  workflow_dispatch:
    inputs:
      agent_id:
        description: 'Agent ID to verify'
        required: true

jobs:
  policy-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: APort Policy Verification
        uses: aporthq/policy-verify-action@v1.0.1
        with:
          agent-id: ${{ github.event.inputs.agent_id || secrets.APORT_AGENT_ID }}
          policy-pack: 'code.repository.merge.v1'
          api-base: 'https://api.aport.io'
          api-key: ${{ secrets.APORT_API_KEY }}
          fail-on-violation: true
          comment-on-pr: true
          timeout-seconds: 30

🔒 Security Enhancements

Credential Protection

✅ API keys masked in logs
✅ Secure credential handling
✅ Input sanitization
✅ Error message sanitization

Audit Trail

✅ Complete request tracking with IDs
✅ Detailed logging for compliance
✅ Performance metrics tracking
✅ Error reporting and debugging

🏗️ Setup Requirements

Required Secrets

# Required
APORT_AGENT_ID=ap_1234567890abcdef

# Optional (for API authentication)
APORT_API_KEY=aport_sk_...

# Optional (for PR comments)
GITHUB_TOKEN=ghp_...

Agent Passport Configuration

{
  "name": "My GitHub Bot",
  "capabilities": ["code.repository.merge.v1"],
  "assurance_level": 3,
  "integrations": {
    "github": {
      "allowed_actors": ["your-bot[bot]", "acme-ci"],
      "allowed_apps": ["your-github-app"]
    }
  },
  "limits": {
    "max_files_changed": 100,
    "max_lines_added": 1000,
    "max_pr_size_kb": 500,
    "required_reviews": 1
  }
}

🚨 Breaking Changes

None - This release is fully backward compatible with v1.0.0.

🔄 Migration Guide

From v1.0.0 to v1.0.1

Update your action reference:

# Change from:
uses: aporthq/policy-verify-action@v1.0.0

# To:
uses: aporthq/policy-verify-action@v1.0.1

Optional: Add new parameters for enhanced functionality:

with:
  agent-id: ${{ secrets.APORT_AGENT_ID }}
  api-key: ${{ secrets.APORT_API_KEY }}  # New
  timeout-seconds: 30                    # New

📈 Performance Improvements

✅ Faster API Responses - Optimized request handling
✅ Better Error Recovery - Retry logic with exponential backoff
✅ Reduced Timeouts - Configurable timeout settings
✅ Improved Logging - More efficient logging and debugging

🤝 Community & Support

Get Help

Contributing

Fork the repository
Create a feature branch
Make your changes
Submit a pull request

🎯 What's Next

Upcoming Features (v1.1.0)

Custom Policy Packs - Create your own policy configurations
Enhanced Analytics - Detailed usage and compliance reporting
Multi-Agent Support - Verify multiple agents in one workflow
Performance Dashboard - Real-time monitoring and metrics

📄 License & Legal

License: MIT License
Privacy: Privacy Policy
Terms: Terms of Service

🙏 Thank You

Thank you to all the contributors, testers, and early adopters who provided feedback and helped make this release possible! Your input was crucial in creating a robust, secure, and production-ready solution.

Ready to secure your repositories with enterprise-grade AI agent verification? Get started with v1.0.1! 🚀

For more information, visit aport.io

Assets:

Source code (zip)
Source code (tar.gz)


This release note covers all the major improvements and fixes we made, including the critical API response parsing fix, Joi schema alignment, enhanced error handling, comprehensive documentation, and production-ready features.

Assets 2

APort Policy Verification Action v1.0.0

Marketplace

uchibeke released this 24 Sep 06:28

v1.0.0

41fbffb

APort Policy Verification Action v1.0.0

🛡️ Secure Your Repositories with AI Agent Verification

We're excited to announce the first public release of the APort Policy Verification GitHub Action! This powerful security tool ensures only authorized AI agents and bots can make changes to your repositories, providing enterprise-grade protection for your development workflows.

✨ What's New in v1.0.0

🔒 Core Security Features

Policy Enforcement - Verify pull requests against APort agent policies
GitHub Integration - Seamless integration with GitHub Actions workflows
Context Mapping - Automatic mapping of GitHub context to APort policies
Flexible Configuration - Customizable policy packs and enforcement rules
PR Comments - Automatic PR comments with detailed policy results
Multiple Triggers - Support for various GitHub events and manual dispatch

🎯 Advanced Capabilities

Repository Safety (repo.v1) - Comprehensive repository-level safety policies
Actor Validation - Verify GitHub actors and apps are authorized
Size Limits - Prevent oversized PRs and file uploads
Review Requirements - Enforce code review policies
Path Allowlists - Restrict file access patterns
Branch Protection - Control which branches can receive PRs

�� Key Features Overview

Feature	Description	Impact
🛡️ Policy Enforcement	Verify PRs against APort agent policies	High Security
🔄 GitHub Integration	Seamless workflow integration	Easy Adoption
📝 PR Comments	Automatic policy result reporting	Clear Feedback
⚙️ Flexible Config	Customizable policy packs	Enterprise Ready
🔍 Context Mapping	Auto-maps GitHub context to policies	Smart Automation

�� Quick Start

1. Basic Setup (30 seconds)

name: APort Policy Check
on: [pull_request]

jobs:
  policy-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aporthq/policy-verify-action@v1
        with:
          agent-id: ${{ secrets.APORT_AGENT_ID }}

2. Advanced Configuration

name: Advanced APort Policy Check
on:
  pull_request:
    types: [opened, synchronize, labeled, ready_for_review]
  workflow_dispatch:
    inputs:
      agent_id:
        description: 'Agent ID to verify'
        required: true

jobs:
  policy-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: APort Policy Verification
        uses: aporthq/policy-verify-action@v1
        with:
          agent-id: ${{ github.event.inputs.agent_id || secrets.APORT_AGENT_ID }}
          policy-pack: ['repo.v1'](https://aport.io/policy-packs/repo.v1/)
          api-base: 'https://api.aport.io'
          fail-on-violation: true
          comment-on-pr: true

🔧 Configuration Options

Input Parameters

Parameter	Description	Required	Default
`agent-id`	APort Agent ID for verification	✅	-
`policy-pack`	Policy pack to enforce	❌	`repo.v1`
`api-base`	APort API base URL	❌	`https://api.aport.io`
`fail-on-violation`	Fail workflow on policy violation	❌	`true`
`comment-on-pr`	Add PR comment with results	❌	`true`

Output Values

Output	Description
`allowed`	Boolean indicating if action is allowed
`reasons`	JSON array of policy violation reasons

📈 Policy Packs

repo.v1 - Repository Safety

Enforces comprehensive repository-level safety policies:

Required Capabilities:

repo.pr.create - Create pull requests
repo.merge - Merge pull requests

Required Limits:

max_prs_per_day - Daily PR creation limit
max_merges_per_day - Daily merge limit
max_pr_size_kb - Maximum PR size in KB

Enforcement Rules:

Repository Allowlist - Restrict which repositories the agent can act on
Base Branch Allowlist - Control which branches can receive PRs
Path Allowlist - Restrict file access patterns
Size Limits - Prevent oversized PRs and file uploads
Review Requirements - Enforce code review policies
GitHub Actor Validation - Verify the GitHub actor is authorized
GitHub App Validation - Verify the GitHub app is authorized

Minimum Assurance Level: L2 (Level 2)

🔍 Context Mapping

The action automatically maps GitHub context to APort policy context:

GitHub Context	APort Context	Description
`github.repository`	`repo`	Repository name
`github.event.pull_request.base.ref`	`base_branch`	Target branch
`github.actor`	`github_actor`	GitHub actor
`github.app`	`github_app`	GitHub app
Computed diff stats	`files_changed`, `lines_added`	Change statistics
PR size calculation	`pr_size_kb`	PR size in KB for size limits
Changed file paths	`file_paths`	File paths for path allowlist enforcement
Review requirements	`requires_review`	Whether review is required
PR labels	`labels`	Pull request labels
Review count	`reviews`	Number of reviews
Draft status	`is_draft`	Whether PR is draft
Mergeable status	`is_mergeable`	Whether PR can be merged

🏗️ Setup Guide

1. Create APort Agent

Go to APort Dashboard
Create a new agent
Configure policy settings
Note the Agent ID

2. Set GitHub Secrets

Add the following secrets to your repository:

# Required
APORT_AGENT_ID=your-agent-id-here

# Optional (for PR comments)
GITHUB_TOKEN=your-github-token

3. Configure Agent Passport (NOT TESTED)

In your APort agent passport, set up the following:

{
  "integrations": {
    "github": {
      "allowed_actors": ["your-bot[bot]", "acme-ci"],
      "allowed_apps": ["your-github-app"]
    }
  },
  "capabilities": ["repo.v1"],
  "assurance_level": 3
}

🚨 Troubleshooting

Common Issues

Agent not found
- Verify APORT_AGENT_ID is correct
- Check agent exists in APort dashboard
Policy violations
- Review agent passport configuration
- Check policy pack requirements
- Verify GitHub actor/app permissions
API errors
- Verify api-base URL is correct
- Check network connectivity
- Review API rate limits

Debug Mode

Enable debug logging:

- name: APort Policy Verification
  uses: aporthq/policy-verify-action@v1
  with:
    agent-id: ${{ secrets.APORT_AGENT_ID }}
    debug: true

📚 Examples & Documentation

Complete Examples

Documentation

🤝 Community & Support

Get Help

Contribute

Fork the repository
Create a feature branch
Make your changes
Submit a pull request

What's Next

Upcoming Features (v1.1.0)

Custom Policy Packs - Create your own policy configurations
Enhanced Logging - More detailed debug information
Performance Metrics - Track action execution times
Multi-Agent Support - Verify multiple agents in one workflow

Future Roadmap

Enterprise Features - Advanced compliance reporting
Integration Hub - Connect with more CI/CD tools
Policy Templates - Pre-built policy configurations
Analytics Dashboard - Usage and compliance insights

* License & Legal**

License: MIT License
Privacy: Privacy Policy
Terms: Terms of Service

Thank You

Thank you to all the contributors, testers, and early adopters who helped make this release possible! Your feedback and support have been invaluable in creating a robust and secure solution for AI agent verification.

Ready to secure your repositories? Get started now! 🚀

*For more information, visit aport.io *

Assets 2

Uh oh!

Releases: aporthq/policy-verify-action

Release list

APort Repository Guard v1.0.7

APort Repository Guard v1.0.7

Changes

Uh oh!

APort Repository Guard v1.0.6

APort Repository Guard v1.0.6

Changes

Uh oh!

APort Repository Guard v1.0.5

APort Repository Guard v1.0.5

Changes

Uh oh!

APort Repository Guard v1.0.4

APort Repository Guard v1.0.4

Changes

Uh oh!

APort Repository Guard v1.0.3

APort Repository Guard v1.0.3

Changes

Uh oh!

APort Repository Guard v1.0.2

What Changed

Usage

Notes

Validation

Uh oh!

APort Policy Verification Action v1.0.1

🚀 Production-Ready Release with Critical Fixes

✨ What's New in v1.0.1

🔧 Critical Fixes

🛡️ Enhanced Security & Reliability

📊 Improved User Experience

🔧 Technical Improvements

API Integration

Schema Validation

Context Mapping

📋 Configuration Updates

New Input Parameters

Enhanced Input Validation

🧪 Testing & Quality Assurance

Comprehensive Test Suite

Quality Metrics

📚 Documentation Improvements

Enhanced README

Example Files

🚀 Quick Start (Updated)

1. Basic Usage

2. Advanced Configuration

🔒 Security Enhancements

Credential Protection

Audit Trail

🏗️ Setup Requirements

Required Secrets

Agent Passport Configuration

🚨 Breaking Changes

🔄 Migration Guide

From v1.0.0 to v1.0.1

📈 Performance Improvements

🤝 Community & Support

Get Help

Contributing

🎯 What's Next

Upcoming Features (v1.1.0)

📄 License & Legal

🙏 Thank You

Uh oh!