Agents

GitHub CI/CD Governance

Install the GitHub CI/CD Governance pack when a team uses GitHub Actions for pull-request checks, releases, or deployments. It adds three assets to delivery:github-actions:

github-cicd-coding-standards
github-cicd-review-skill
github-cicd-knowledge-base

Install the pack

curl --fail-with-body \
  --request POST \
  "$NEUTRON_API_URL/v1/platform/industry-library/plugins/github-cicd-governance/install" \
  --header "Authorization: Bearer $NEUTRON_WORKSPACE_API_KEY" \
  --header "Content-Type: application/json" \
  --data "{\"nucleusId\":\"$NEUTRON_NUCLEUS_ID\"}"

Add delivery:github-actions to every context request that changes:

.github/workflows/**
local composite, JavaScript, or Docker actions
release and deployment scripts
Dependabot, dependency review, or CodeQL configuration
artifact, container, package, or provenance handling
ruleset, protected-branch, environment, or required-check documentation

What the standards enforce

Triggers and trust

Identify event, actor, fork state, source repository, base/head revision, and checked-out code.
Treat issue text, pull-request metadata, branch names, commit messages, event payloads, matrix values, artifacts, and cache contents as untrusted.
Never execute untrusted pull-request code inside a privileged pull_request_target job.
Keep trusted release and deployment workflows separate from untrusted validation work.

Permissions and credentials

Set permissions: {} or a read-only baseline, then grant the minimum rights per job.
Prefer GitHub OIDC and tightly constrained cloud trust claims over long-lived cloud credentials.
Scope secrets to the smallest repository, environment, job, and step boundary.
Use protected environments and human approval for sensitive deployments.
Do not rely on masking to make transformed, encoded, sliced, or command-line secret values safe.

Dependencies and supply chain

Pin third-party actions to reviewed full-length commit SHAs.
Review action source, update automation, lockfile changes, build scripts, package-manager plugins, and generated code.
Require dependency review and supported static/security analysis appropriate to the repository.
Generate and verify artifact attestations or SBOMs when release policy requires provenance.

Reliability and evidence

Give jobs explicit timeouts and deployments deliberate concurrency behavior.
Make deploy operations idempotent and define rollback or roll-forward behavior.
Set artifact and log retention according to sensitivity.
Preserve the commit SHA, workflow run, checks, artifact digest, approval, attestation verification, deployment result, and rollback evidence required by release policy.

This readable example uses major action tags. Production repositories following the installed policy should replace third-party action tags with reviewed full commit SHAs and let approved dependency automation propose updates.

name: Engineering governance

on:
  pull_request:
  push:
    branches: [main]

permissions: {}

concurrency:
  group: governance-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: Required engineering checks
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read

    steps:
      - name: Check out the reviewed revision
        uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Enable Corepack
        run: corepack enable

      - name: Set up Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: .node-version
          cache: pnpm

      - name: Install locked dependencies
        run: pnpm install --frozen-lockfile

      - name: Check formatting
        run: pnpm format:check

      - name: Run static analysis
        run: pnpm lint

      - name: Check types
        run: pnpm typecheck

      - name: Run tests
        run: pnpm test

      - name: Build production assets
        run: pnpm build

Adapt commands to the repository. Do not add imaginary scripts just to make a generic workflow look complete.

Safe deployment pattern

Use a separate trusted workflow or job for deployment:

deploy-production:
  needs: verify
  if: github.event_name == 'push' && github.ref == 'refs/heads/main'
  runs-on: ubuntu-latest
  timeout-minutes: 20
  environment: production
  permissions:
    contents: read
    id-token: write

  steps:
    - name: Check out the approved revision
      uses: actions/checkout@v6
      with:
        persist-credentials: false

    - name: Authenticate with short-lived cloud identity
      uses: cloud-provider/login-action@<reviewed-full-commit-sha>

    - name: Deploy the immutable artifact
      run: ./scripts/deploy-approved-artifact.sh

The cloud trust policy should constrain organization, repository, workflow, branch or protected environment, audience, and any reusable-workflow claims required by the provider. id-token: write permits requesting an OIDC token; the cloud policy decides what that identity can access.

Neutron use during workflow changes

Request delivery and language policy before editing:

{
  "nucleusId": "payments-service",
  "scopeIds": [
    "governance:team-code",
    "delivery:github-actions",
    "standards:typescript-javascript",
    "repo:root",
    "infra:cloudflare",
    "tests:release",
    "agent:copilot"
  ],
  "agentId": "agent:copilot",
  "task": "Add provenance to the release workflow without broadening deployment permissions.",
  "tokenBudget": 1600
}

The review skill checks:

triggers and actor trust
effective workflow and job permissions
expressions entering shell, paths, cache keys, artifacts, matrices, and action inputs
action provenance and immutable pins
secrets, OIDC claims, environments, approvals, concurrency, and timeouts
required language, dependency, security, build, and release checks
artifact integrity, retention, attestations, and rollback evidence

It returns findings before a summary and separates repository-file evidence from GitHub settings that require administrator verification.

Protect the merge boundary

Configure repository or organization rulesets so required checks cannot be bypassed by an agent-authored summary. At minimum, consider:

required pull requests and approving reviews
code-owner review for workflows, security, infrastructure, and release paths
required status checks with stable unique job names
dismissal or reapproval after material changes
restricted force pushes, deletions, tags, and release branches
environment reviewers and deployment branch restrictions
signed commits or attestations where policy requires them

These settings live outside workflow YAML. The coding agent must not claim they are enabled unless it inspected the authorized repository settings or received current administrator evidence.

Source anchors

Language Governance Packs

Memory + Consequence Agents