APort Repository Guard v1.0.2

This release updates aporthq/policy-verify-action from the old API-key PR policy check into the new APort Repository Guard.

What Changed

• Adds default auto mode: the Action requests GitHub OIDC, creates or reuses a hosted repository/workflow-scoped OAP passport, and calls APort Verify for code.repository.merge.v1.
• Adds safe fallback behavior: when hosted verification is unavailable in auto, the Action falls back to clearly labelled evidence-only reporting instead of pretending hosted verification succeeded.
• Adds explicit hosted, local-json, and evidence-only modes.
• Adds hosted decision signature verification against APort OAP JWKS before using a hosted decision.
• Adds report-only repository provenance for PRs: actor classification, APort commit trailer recognition, protected-path findings, workflow write-permission escalation, and pull_request_target detection.
• Adds trusted base-branch .aport/policy.yaml / .aport/policy.yml support for Action-side evidence configuration.
• Removes the requirement for a user-managed APort account, passport ID, API key, secret, or PR comments in the default free path.

Usage

name: APort Repository Guard
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled, review_requested, review_request_removed]
  pull_request_review:
    types: [submitted, dismissed]

permissions:
  id-token: write
  contents: read
  pull-requests: read

jobs:
  aport:
    runs-on: ubuntu-latest
    steps:
      - uses: aporthq/policy-verify-action@v1.0.2

Notes

• Default mode exits 0 and writes findings to $GITHUB_STEP_SUMMARY.
• Explicit hosted mode fails if signed hosted verification cannot complete or returns deny.
• local-json mode reads a trusted OAP passport from the base workflow ref and posts it to APort Verify without hosted decision persistence.
• evidence-only mode makes no APort network calls.

Validation

• npm test
• npm run validate
• injected-signature scan clean for known obfuscation markers