[{"data":1,"prerenderedAt":1557},["ShallowReactive",2],{"docs-navigation":3,"docs-page-\u002Fdocs\u002Fagents\u002Fcode-governance\u002Fgithub-cicd":252,"docs-surround-\u002Fdocs\u002Fagents\u002Fcode-governance\u002Fgithub-cicd":1554},[4],{"title":5,"path":6,"stem":7,"children":8,"page":251},"Docs","\u002Fdocs","docs",[9,36,101,197,232],{"title":10,"path":11,"stem":12,"children":13},"GET STARTED","\u002Fdocs\u002Fget-started","docs\u002F1.get-started\u002F1.index",[14,16,20,24,28,32],{"title":15,"path":11,"stem":12},"Welcome",{"title":17,"path":18,"stem":19},"Quickstart","\u002Fdocs\u002Fget-started\u002Fquickstart","docs\u002F1.get-started\u002F2.quickstart",{"title":21,"path":22,"stem":23},"API","\u002Fdocs\u002Fget-started\u002Fapi","docs\u002F1.get-started\u002F3.api",{"title":25,"path":26,"stem":27},"SDKs and CLI","\u002Fdocs\u002Fget-started\u002Fsdks-cli","docs\u002F1.get-started\u002F4.sdks-cli",{"title":29,"path":30,"stem":31},"Sandbox testing","\u002Fdocs\u002Fget-started\u002Flocal-development","docs\u002F1.get-started\u002F5.local-development",{"title":33,"path":34,"stem":35},"Authentication","\u002Fdocs\u002Fget-started\u002Fauthentication","docs\u002F1.get-started\u002F6.authentication",{"title":37,"path":38,"stem":39,"children":40},"FUNDAMENTALS","\u002Fdocs\u002Ffundamentals","docs\u002F2.fundamentals\u002F01.index",[41,43,47,51,55,59,63,67,71,75],{"title":42,"path":38,"stem":39},"Fundamentals",{"title":44,"path":45,"stem":46},"Architecture","\u002Fdocs\u002Ffundamentals\u002Farchitecture","docs\u002F2.fundamentals\u002F02.architecture",{"title":48,"path":49,"stem":50},"Memory model","\u002Fdocs\u002Ffundamentals\u002Fmemory-model","docs\u002F2.fundamentals\u002F03.memory-model",{"title":52,"path":53,"stem":54},"Compression","\u002Fdocs\u002Ffundamentals\u002Fcompression","docs\u002F2.fundamentals\u002F04.compression",{"title":56,"path":57,"stem":58},"RAG and cached context","\u002Fdocs\u002Ffundamentals\u002Frag-cag","docs\u002F2.fundamentals\u002F05.rag-cag",{"title":60,"path":61,"stem":62},"Context cache","\u002Fdocs\u002Ffundamentals\u002Fcontext-cache","docs\u002F2.fundamentals\u002F06.context-cache",{"title":64,"path":65,"stem":66},"Security","\u002Fdocs\u002Ffundamentals\u002Fsecurity","docs\u002F2.fundamentals\u002F07.security",{"title":68,"path":69,"stem":70},"Languages","\u002Fdocs\u002Ffundamentals\u002Flanguages","docs\u002F2.fundamentals\u002F08.languages",{"title":72,"path":73,"stem":74},"UI patterns","\u002Fdocs\u002Ffundamentals\u002Fui","docs\u002F2.fundamentals\u002F09.ui",{"title":76,"path":77,"stem":78,"children":79},"Global, Regional, and Jurisdictional Memory","\u002Fdocs\u002Ffundamentals\u002Fdata-placement","docs\u002F2.fundamentals\u002F10.data-placement\u002F1.index",[80,81,85,89,93,97],{"title":76,"path":77,"stem":78},{"title":82,"path":83,"stem":84},"TypeScript \u002F JavaScript","\u002Fdocs\u002Ffundamentals\u002Fdata-placement\u002Ftypescript","docs\u002F2.fundamentals\u002F10.data-placement\u002F2.typescript",{"title":86,"path":87,"stem":88},"Python","\u002Fdocs\u002Ffundamentals\u002Fdata-placement\u002Fpython","docs\u002F2.fundamentals\u002F10.data-placement\u002F3.python",{"title":90,"path":91,"stem":92},"PHP","\u002Fdocs\u002Ffundamentals\u002Fdata-placement\u002Fphp","docs\u002F2.fundamentals\u002F10.data-placement\u002F4.php",{"title":94,"path":95,"stem":96},"Go","\u002Fdocs\u002Ffundamentals\u002Fdata-placement\u002Fgo","docs\u002F2.fundamentals\u002F10.data-placement\u002F5.go",{"title":98,"path":99,"stem":100},"Rust","\u002Fdocs\u002Ffundamentals\u002Fdata-placement\u002Frust","docs\u002F2.fundamentals\u002F10.data-placement\u002F6.rust",{"title":102,"path":103,"stem":104,"children":105},"AGENTS & CODE NUCLEI","\u002Fdocs\u002Fagents","docs\u002F3.agents\u002F01.index",[106,108,112,116,120,124,128,132,136,140,158,193],{"title":107,"path":103,"stem":104},"Agents",{"title":109,"path":110,"stem":111},"Codex Code Nucleus","\u002Fdocs\u002Fagents\u002Fcodex-code-nucleus","docs\u002F3.agents\u002F02.codex-code-nucleus",{"title":113,"path":114,"stem":115},"Claude Code Nucleus","\u002Fdocs\u002Fagents\u002Fclaude-code-nucleus","docs\u002F3.agents\u002F03.claude-code-nucleus",{"title":117,"path":118,"stem":119},"Google Gemini Code Nucleus","\u002Fdocs\u002Fagents\u002Fgoogle-gemini-code-nucleus","docs\u002F3.agents\u002F04.google-gemini-code-nucleus",{"title":121,"path":122,"stem":123},"GitHub Copilot Code Nucleus","\u002Fdocs\u002Fagents\u002Fgithub-copilot-code-nucleus","docs\u002F3.agents\u002F05.github-copilot-code-nucleus",{"title":125,"path":126,"stem":127},"Cursor Code Nucleus","\u002Fdocs\u002Fagents\u002Fcursor-code-nucleus","docs\u002F3.agents\u002F06.cursor-code-nucleus",{"title":129,"path":130,"stem":131},"Windsurf Code Nucleus","\u002Fdocs\u002Fagents\u002Fwindsurf-code-nucleus","docs\u002F3.agents\u002F07.windsurf-code-nucleus",{"title":133,"path":134,"stem":135},"Agent skills","\u002Fdocs\u002Fagents\u002Fagent-skills","docs\u002F3.agents\u002F08.agent-skills",{"title":137,"path":138,"stem":139},"Admin UI prompt","\u002Fdocs\u002Fagents\u002Fadmin-ui-prompt","docs\u002F3.agents\u002F09.admin-ui-prompt",{"title":141,"path":142,"stem":143,"children":144},"Team Code Governance","\u002Fdocs\u002Fagents\u002Fcode-governance","docs\u002F3.agents\u002F10.code-governance\u002F1.index",[145,146,150,154],{"title":141,"path":142,"stem":143},{"title":147,"path":148,"stem":149},"Local Team Setup","\u002Fdocs\u002Fagents\u002Fcode-governance\u002Flocal-team-setup","docs\u002F3.agents\u002F10.code-governance\u002F2.local-team-setup",{"title":151,"path":152,"stem":153},"Language Governance Packs","\u002Fdocs\u002Fagents\u002Fcode-governance\u002Flanguage-packs","docs\u002F3.agents\u002F10.code-governance\u002F3.language-packs",{"title":155,"path":156,"stem":157},"GitHub CI\u002FCD Governance","\u002Fdocs\u002Fagents\u002Fcode-governance\u002Fgithub-cicd","docs\u002F3.agents\u002F10.code-governance\u002F4.github-cicd",{"title":159,"path":160,"stem":161,"children":162},"Memory + Consequence Agents","\u002Fdocs\u002Fagents\u002Fmemory-consequence-agents","docs\u002F3.agents\u002F11.memory-consequence-agents\u002F1.index",[163,164,185,189],{"title":159,"path":160,"stem":161},{"title":165,"path":166,"stem":167,"children":168},"End-to-End Agent Example","\u002Fdocs\u002Fagents\u002Fmemory-consequence-agents\u002Fend-to-end","docs\u002F3.agents\u002F11.memory-consequence-agents\u002F2.end-to-end\u002F1.index",[169,170,173,176,179,182],{"title":165,"path":166,"stem":167},{"title":82,"path":171,"stem":172},"\u002Fdocs\u002Fagents\u002Fmemory-consequence-agents\u002Fend-to-end\u002Ftypescript","docs\u002F3.agents\u002F11.memory-consequence-agents\u002F2.end-to-end\u002F2.typescript",{"title":86,"path":174,"stem":175},"\u002Fdocs\u002Fagents\u002Fmemory-consequence-agents\u002Fend-to-end\u002Fpython","docs\u002F3.agents\u002F11.memory-consequence-agents\u002F2.end-to-end\u002F3.python",{"title":90,"path":177,"stem":178},"\u002Fdocs\u002Fagents\u002Fmemory-consequence-agents\u002Fend-to-end\u002Fphp","docs\u002F3.agents\u002F11.memory-consequence-agents\u002F2.end-to-end\u002F4.php",{"title":94,"path":180,"stem":181},"\u002Fdocs\u002Fagents\u002Fmemory-consequence-agents\u002Fend-to-end\u002Fgo","docs\u002F3.agents\u002F11.memory-consequence-agents\u002F2.end-to-end\u002F5.go",{"title":98,"path":183,"stem":184},"\u002Fdocs\u002Fagents\u002Fmemory-consequence-agents\u002Fend-to-end\u002Frust","docs\u002F3.agents\u002F11.memory-consequence-agents\u002F2.end-to-end\u002F6.rust",{"title":186,"path":187,"stem":188},"Industry Agent Use Cases","\u002Fdocs\u002Fagents\u002Fmemory-consequence-agents\u002Findustry-use-cases","docs\u002F3.agents\u002F11.memory-consequence-agents\u002F3.industry-use-cases",{"title":190,"path":191,"stem":192},"Historical Actions and Learning","\u002Fdocs\u002Fagents\u002Fmemory-consequence-agents\u002Fhistorical-learning","docs\u002F3.agents\u002F11.memory-consequence-agents\u002F4.historical-learning",{"title":194,"path":195,"stem":196},"Consequence decision support","\u002Fdocs\u002Fagents\u002Fconsequence","docs\u002F3.agents\u002F12.consequence",{"title":198,"path":199,"stem":200,"children":201},"MODEL PROVIDERS","\u002Fdocs\u002Fproviders","docs\u002F4.providers\u002F1.index",[202,204,208,212,216,220,224,228],{"title":203,"path":199,"stem":200},"Providers",{"title":205,"path":206,"stem":207},"OpenAI and Azure OpenAI","\u002Fdocs\u002Fproviders\u002Fopenai","docs\u002F4.providers\u002F2.openai",{"title":209,"path":210,"stem":211},"Anthropic Claude","\u002Fdocs\u002Fproviders\u002Fanthropic","docs\u002F4.providers\u002F3.anthropic",{"title":213,"path":214,"stem":215},"Google Gemini and Vertex AI","\u002Fdocs\u002Fproviders\u002Fgoogle-gemini","docs\u002F4.providers\u002F4.google-gemini",{"title":217,"path":218,"stem":219},"OpenAI-compatible providers","\u002Fdocs\u002Fproviders\u002Fopenai-compatible","docs\u002F4.providers\u002F5.openai-compatible",{"title":221,"path":222,"stem":223},"Groq","\u002Fdocs\u002Fproviders\u002Fgroq","docs\u002F4.providers\u002F6.groq",{"title":225,"path":226,"stem":227},"Cohere","\u002Fdocs\u002Fproviders\u002Fcohere","docs\u002F4.providers\u002F7.cohere",{"title":229,"path":230,"stem":231},"Amazon Bedrock","\u002Fdocs\u002Fproviders\u002Famazon-bedrock","docs\u002F4.providers\u002F8.amazon-bedrock",{"title":233,"path":234,"stem":235,"children":236},"CHANGELOG","\u002Fdocs\u002Fchangelog","docs\u002F5.changelog\u002F1.index",[237,239,243,247],{"title":238,"path":234,"stem":235},"Changelog",{"title":240,"path":241,"stem":242},"Roadmap","\u002Fdocs\u002Fchangelog\u002Froadmap","docs\u002F5.changelog\u002F2.roadmap",{"title":244,"path":245,"stem":246},"Release notes","\u002Fdocs\u002Fchangelog\u002Frelease-runbook","docs\u002F5.changelog\u002F3.release-runbook",{"title":248,"path":249,"stem":250},"Testing","\u002Fdocs\u002Fchangelog\u002Ftesting","docs\u002F5.changelog\u002F4.testing",false,{"id":253,"title":155,"body":254,"description":1549,"extension":1550,"meta":1551,"navigation":557,"path":156,"seo":1552,"stem":157,"__hash__":1553},"docs\u002Fdocs\u002F3.agents\u002F10.code-governance\u002F4.github-cicd.md",{"type":255,"value":256,"toc":1535},"minimark",[257,261,270,289,294,412,418,440,444,449,467,471,492,496,510,514,528,532,535,1026,1029,1033,1036,1219,1226,1230,1233,1418,1421,1445,1448,1452,1455,1478,1481,1485,1531],[258,259,155],"h1",{"id":260},"github-cicd-governance",[262,263,264,265,269],"p",{},"Install the GitHub CI\u002FCD Governance pack when a team uses GitHub Actions for pull-request checks, releases, or deployments. It adds three assets to ",[266,267,268],"code",{},"delivery:github-actions",":",[271,272,273,279,284],"ul",{},[274,275,276],"li",{},[266,277,278],{},"github-cicd-coding-standards",[274,280,281],{},[266,282,283],{},"github-cicd-review-skill",[274,285,286],{},[266,287,288],{},"github-cicd-knowledge-base",[290,291,293],"h2",{"id":292},"install-the-pack","Install the pack",[295,296,301],"pre",{"className":297,"code":298,"language":299,"meta":300,"style":300},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl --fail-with-body \\\n  --request POST \\\n  \"$NEUTRON_API_URL\u002Fv1\u002Fplatform\u002Findustry-library\u002Fplugins\u002Fgithub-cicd-governance\u002Finstall\" \\\n  --header \"Authorization: Bearer $NEUTRON_WORKSPACE_API_KEY\" \\\n  --header \"Content-Type: application\u002Fjson\" \\\n  --data \"{\\\"nucleusId\\\":\\\"$NEUTRON_NUCLEUS_ID\\\"}\"\n","bash","",[266,302,303,320,331,349,368,382],{"__ignoreMap":300},[304,305,308,312,316],"span",{"class":306,"line":307},"line",1,[304,309,311],{"class":310},"sBMFI","curl",[304,313,315],{"class":314},"sfazB"," --fail-with-body",[304,317,319],{"class":318},"sTEyZ"," \\\n",[304,321,323,326,329],{"class":306,"line":322},2,[304,324,325],{"class":314},"  --request",[304,327,328],{"class":314}," POST",[304,330,319],{"class":318},[304,332,334,338,341,344,347],{"class":306,"line":333},3,[304,335,337],{"class":336},"sMK4o","  \"",[304,339,340],{"class":318},"$NEUTRON_API_URL",[304,342,343],{"class":314},"\u002Fv1\u002Fplatform\u002Findustry-library\u002Fplugins\u002Fgithub-cicd-governance\u002Finstall",[304,345,346],{"class":336},"\"",[304,348,319],{"class":318},[304,350,352,355,358,361,364,366],{"class":306,"line":351},4,[304,353,354],{"class":314},"  --header",[304,356,357],{"class":336}," \"",[304,359,360],{"class":314},"Authorization: Bearer ",[304,362,363],{"class":318},"$NEUTRON_WORKSPACE_API_KEY",[304,365,346],{"class":336},[304,367,319],{"class":318},[304,369,371,373,375,378,380],{"class":306,"line":370},5,[304,372,354],{"class":314},[304,374,357],{"class":336},[304,376,377],{"class":314},"Content-Type: application\u002Fjson",[304,379,346],{"class":336},[304,381,319],{"class":318},[304,383,385,388,390,393,396,399,401,403,406,409],{"class":306,"line":384},6,[304,386,387],{"class":314},"  --data",[304,389,357],{"class":336},[304,391,392],{"class":314},"{",[304,394,395],{"class":318},"\\\"",[304,397,398],{"class":314},"nucleusId",[304,400,395],{"class":318},[304,402,269],{"class":314},[304,404,405],{"class":318},"\\\"$NEUTRON_NUCLEUS_ID\\\"",[304,407,408],{"class":314},"}",[304,410,411],{"class":336},"\"\n",[262,413,414,415,417],{},"Add ",[266,416,268],{}," to every context request that changes:",[271,419,420,425,428,431,434,437],{},[274,421,422],{},[266,423,424],{},".github\u002Fworkflows\u002F**",[274,426,427],{},"local composite, JavaScript, or Docker actions",[274,429,430],{},"release and deployment scripts",[274,432,433],{},"Dependabot, dependency review, or CodeQL configuration",[274,435,436],{},"artifact, container, package, or provenance handling",[274,438,439],{},"ruleset, protected-branch, environment, or required-check documentation",[290,441,443],{"id":442},"what-the-standards-enforce","What the standards enforce",[445,446,448],"h3",{"id":447},"triggers-and-trust","Triggers and trust",[271,450,451,454,457,464],{},[274,452,453],{},"Identify event, actor, fork state, source repository, base\u002Fhead revision, and checked-out code.",[274,455,456],{},"Treat issue text, pull-request metadata, branch names, commit messages, event payloads, matrix values, artifacts, and cache contents as untrusted.",[274,458,459,460,463],{},"Never execute untrusted pull-request code inside a privileged ",[266,461,462],{},"pull_request_target"," job.",[274,465,466],{},"Keep trusted release and deployment workflows separate from untrusted validation work.",[445,468,470],{"id":469},"permissions-and-credentials","Permissions and credentials",[271,472,473,480,483,486,489],{},[274,474,475,476,479],{},"Set ",[266,477,478],{},"permissions: {}"," or a read-only baseline, then grant the minimum rights per job.",[274,481,482],{},"Prefer GitHub OIDC and tightly constrained cloud trust claims over long-lived cloud credentials.",[274,484,485],{},"Scope secrets to the smallest repository, environment, job, and step boundary.",[274,487,488],{},"Use protected environments and human approval for sensitive deployments.",[274,490,491],{},"Do not rely on masking to make transformed, encoded, sliced, or command-line secret values safe.",[445,493,495],{"id":494},"dependencies-and-supply-chain","Dependencies and supply chain",[271,497,498,501,504,507],{},[274,499,500],{},"Pin third-party actions to reviewed full-length commit SHAs.",[274,502,503],{},"Review action source, update automation, lockfile changes, build scripts, package-manager plugins, and generated code.",[274,505,506],{},"Require dependency review and supported static\u002Fsecurity analysis appropriate to the repository.",[274,508,509],{},"Generate and verify artifact attestations or SBOMs when release policy requires provenance.",[445,511,513],{"id":512},"reliability-and-evidence","Reliability and evidence",[271,515,516,519,522,525],{},[274,517,518],{},"Give jobs explicit timeouts and deployments deliberate concurrency behavior.",[274,520,521],{},"Make deploy operations idempotent and define rollback or roll-forward behavior.",[274,523,524],{},"Set artifact and log retention according to sensitivity.",[274,526,527],{},"Preserve the commit SHA, workflow run, checks, artifact digest, approval, attestation verification, deployment result, and rollback evidence required by release policy.",[290,529,531],{"id":530},"example-governance-workflow","Example governance workflow",[262,533,534],{},"This readable example uses major action tags. Production repositories following the installed policy should replace third-party action tags with reviewed full commit SHAs and let approved dependency automation propose updates.",[295,536,540],{"className":537,"code":538,"language":539,"meta":300,"style":300},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","name: Engineering governance\n\non:\n  pull_request:\n  push:\n    branches: [main]\n\npermissions: {}\n\nconcurrency:\n  group: governance-${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  verify:\n    name: Required engineering checks\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n\n    steps:\n      - name: Check out the reviewed revision\n        uses: actions\u002Fcheckout@v6\n        with:\n          persist-credentials: false\n\n      - name: Enable Corepack\n        run: corepack enable\n\n      - name: Set up Node.js\n        uses: actions\u002Fsetup-node@v6\n        with:\n          node-version-file: .node-version\n          cache: pnpm\n\n      - name: Install locked dependencies\n        run: pnpm install --frozen-lockfile\n\n      - name: Check formatting\n        run: pnpm format:check\n\n      - name: Run static analysis\n        run: pnpm lint\n\n      - name: Check types\n        run: pnpm typecheck\n\n      - name: Run tests\n        run: pnpm test\n\n      - name: Build production assets\n        run: pnpm build\n","yaml",[266,541,542,553,559,568,575,582,598,603,614,619,627,638,649,654,662,670,681,692,704,712,723,728,736,750,761,769,780,785,797,808,813,825,835,842,853,864,869,881,891,896,908,918,923,935,945,950,962,972,977,989,999,1004,1016],{"__ignoreMap":300},[304,543,544,548,550],{"class":306,"line":307},[304,545,547],{"class":546},"swJcz","name",[304,549,269],{"class":336},[304,551,552],{"class":314}," Engineering governance\n",[304,554,555],{"class":306,"line":322},[304,556,558],{"emptyLinePlaceholder":557},true,"\n",[304,560,561,565],{"class":306,"line":333},[304,562,564],{"class":563},"sfNiH","on",[304,566,567],{"class":336},":\n",[304,569,570,573],{"class":306,"line":351},[304,571,572],{"class":546},"  pull_request",[304,574,567],{"class":336},[304,576,577,580],{"class":306,"line":370},[304,578,579],{"class":546},"  push",[304,581,567],{"class":336},[304,583,584,587,589,592,595],{"class":306,"line":384},[304,585,586],{"class":546},"    branches",[304,588,269],{"class":336},[304,590,591],{"class":336}," [",[304,593,594],{"class":314},"main",[304,596,597],{"class":336},"]\n",[304,599,601],{"class":306,"line":600},7,[304,602,558],{"emptyLinePlaceholder":557},[304,604,606,609,611],{"class":306,"line":605},8,[304,607,608],{"class":546},"permissions",[304,610,269],{"class":336},[304,612,613],{"class":336}," {}\n",[304,615,617],{"class":306,"line":616},9,[304,618,558],{"emptyLinePlaceholder":557},[304,620,622,625],{"class":306,"line":621},10,[304,623,624],{"class":546},"concurrency",[304,626,567],{"class":336},[304,628,630,633,635],{"class":306,"line":629},11,[304,631,632],{"class":546},"  group",[304,634,269],{"class":336},[304,636,637],{"class":314}," governance-${{ github.workflow }}-${{ github.ref }}\n",[304,639,641,644,646],{"class":306,"line":640},12,[304,642,643],{"class":546},"  cancel-in-progress",[304,645,269],{"class":336},[304,647,648],{"class":563}," true\n",[304,650,652],{"class":306,"line":651},13,[304,653,558],{"emptyLinePlaceholder":557},[304,655,657,660],{"class":306,"line":656},14,[304,658,659],{"class":546},"jobs",[304,661,567],{"class":336},[304,663,665,668],{"class":306,"line":664},15,[304,666,667],{"class":546},"  verify",[304,669,567],{"class":336},[304,671,673,676,678],{"class":306,"line":672},16,[304,674,675],{"class":546},"    name",[304,677,269],{"class":336},[304,679,680],{"class":314}," Required engineering checks\n",[304,682,684,687,689],{"class":306,"line":683},17,[304,685,686],{"class":546},"    runs-on",[304,688,269],{"class":336},[304,690,691],{"class":314}," ubuntu-latest\n",[304,693,695,698,700],{"class":306,"line":694},18,[304,696,697],{"class":546},"    timeout-minutes",[304,699,269],{"class":336},[304,701,703],{"class":702},"sbssI"," 20\n",[304,705,707,710],{"class":306,"line":706},19,[304,708,709],{"class":546},"    permissions",[304,711,567],{"class":336},[304,713,715,718,720],{"class":306,"line":714},20,[304,716,717],{"class":546},"      contents",[304,719,269],{"class":336},[304,721,722],{"class":314}," read\n",[304,724,726],{"class":306,"line":725},21,[304,727,558],{"emptyLinePlaceholder":557},[304,729,731,734],{"class":306,"line":730},22,[304,732,733],{"class":546},"    steps",[304,735,567],{"class":336},[304,737,739,742,745,747],{"class":306,"line":738},23,[304,740,741],{"class":336},"      -",[304,743,744],{"class":546}," name",[304,746,269],{"class":336},[304,748,749],{"class":314}," Check out the reviewed revision\n",[304,751,753,756,758],{"class":306,"line":752},24,[304,754,755],{"class":546},"        uses",[304,757,269],{"class":336},[304,759,760],{"class":314}," actions\u002Fcheckout@v6\n",[304,762,764,767],{"class":306,"line":763},25,[304,765,766],{"class":546},"        with",[304,768,567],{"class":336},[304,770,772,775,777],{"class":306,"line":771},26,[304,773,774],{"class":546},"          persist-credentials",[304,776,269],{"class":336},[304,778,779],{"class":563}," false\n",[304,781,783],{"class":306,"line":782},27,[304,784,558],{"emptyLinePlaceholder":557},[304,786,788,790,792,794],{"class":306,"line":787},28,[304,789,741],{"class":336},[304,791,744],{"class":546},[304,793,269],{"class":336},[304,795,796],{"class":314}," Enable Corepack\n",[304,798,800,803,805],{"class":306,"line":799},29,[304,801,802],{"class":546},"        run",[304,804,269],{"class":336},[304,806,807],{"class":314}," corepack enable\n",[304,809,811],{"class":306,"line":810},30,[304,812,558],{"emptyLinePlaceholder":557},[304,814,816,818,820,822],{"class":306,"line":815},31,[304,817,741],{"class":336},[304,819,744],{"class":546},[304,821,269],{"class":336},[304,823,824],{"class":314}," Set up Node.js\n",[304,826,828,830,832],{"class":306,"line":827},32,[304,829,755],{"class":546},[304,831,269],{"class":336},[304,833,834],{"class":314}," actions\u002Fsetup-node@v6\n",[304,836,838,840],{"class":306,"line":837},33,[304,839,766],{"class":546},[304,841,567],{"class":336},[304,843,845,848,850],{"class":306,"line":844},34,[304,846,847],{"class":546},"          node-version-file",[304,849,269],{"class":336},[304,851,852],{"class":314}," .node-version\n",[304,854,856,859,861],{"class":306,"line":855},35,[304,857,858],{"class":546},"          cache",[304,860,269],{"class":336},[304,862,863],{"class":314}," pnpm\n",[304,865,867],{"class":306,"line":866},36,[304,868,558],{"emptyLinePlaceholder":557},[304,870,872,874,876,878],{"class":306,"line":871},37,[304,873,741],{"class":336},[304,875,744],{"class":546},[304,877,269],{"class":336},[304,879,880],{"class":314}," Install locked dependencies\n",[304,882,884,886,888],{"class":306,"line":883},38,[304,885,802],{"class":546},[304,887,269],{"class":336},[304,889,890],{"class":314}," pnpm install --frozen-lockfile\n",[304,892,894],{"class":306,"line":893},39,[304,895,558],{"emptyLinePlaceholder":557},[304,897,899,901,903,905],{"class":306,"line":898},40,[304,900,741],{"class":336},[304,902,744],{"class":546},[304,904,269],{"class":336},[304,906,907],{"class":314}," Check formatting\n",[304,909,911,913,915],{"class":306,"line":910},41,[304,912,802],{"class":546},[304,914,269],{"class":336},[304,916,917],{"class":314}," pnpm format:check\n",[304,919,921],{"class":306,"line":920},42,[304,922,558],{"emptyLinePlaceholder":557},[304,924,926,928,930,932],{"class":306,"line":925},43,[304,927,741],{"class":336},[304,929,744],{"class":546},[304,931,269],{"class":336},[304,933,934],{"class":314}," Run static analysis\n",[304,936,938,940,942],{"class":306,"line":937},44,[304,939,802],{"class":546},[304,941,269],{"class":336},[304,943,944],{"class":314}," pnpm lint\n",[304,946,948],{"class":306,"line":947},45,[304,949,558],{"emptyLinePlaceholder":557},[304,951,953,955,957,959],{"class":306,"line":952},46,[304,954,741],{"class":336},[304,956,744],{"class":546},[304,958,269],{"class":336},[304,960,961],{"class":314}," Check types\n",[304,963,965,967,969],{"class":306,"line":964},47,[304,966,802],{"class":546},[304,968,269],{"class":336},[304,970,971],{"class":314}," pnpm typecheck\n",[304,973,975],{"class":306,"line":974},48,[304,976,558],{"emptyLinePlaceholder":557},[304,978,980,982,984,986],{"class":306,"line":979},49,[304,981,741],{"class":336},[304,983,744],{"class":546},[304,985,269],{"class":336},[304,987,988],{"class":314}," Run tests\n",[304,990,992,994,996],{"class":306,"line":991},50,[304,993,802],{"class":546},[304,995,269],{"class":336},[304,997,998],{"class":314}," pnpm test\n",[304,1000,1002],{"class":306,"line":1001},51,[304,1003,558],{"emptyLinePlaceholder":557},[304,1005,1007,1009,1011,1013],{"class":306,"line":1006},52,[304,1008,741],{"class":336},[304,1010,744],{"class":546},[304,1012,269],{"class":336},[304,1014,1015],{"class":314}," Build production assets\n",[304,1017,1019,1021,1023],{"class":306,"line":1018},53,[304,1020,802],{"class":546},[304,1022,269],{"class":336},[304,1024,1025],{"class":314}," pnpm build\n",[262,1027,1028],{},"Adapt commands to the repository. Do not add imaginary scripts just to make a generic workflow look complete.",[290,1030,1032],{"id":1031},"safe-deployment-pattern","Safe deployment pattern",[262,1034,1035],{},"Use a separate trusted workflow or job for deployment:",[295,1037,1039],{"className":537,"code":1038,"language":539,"meta":300,"style":300},"deploy-production:\n  needs: verify\n  if: github.event_name == 'push' && github.ref == 'refs\u002Fheads\u002Fmain'\n  runs-on: ubuntu-latest\n  timeout-minutes: 20\n  environment: production\n  permissions:\n    contents: read\n    id-token: write\n\n  steps:\n    - name: Check out the approved revision\n      uses: actions\u002Fcheckout@v6\n      with:\n        persist-credentials: false\n\n    - name: Authenticate with short-lived cloud identity\n      uses: cloud-provider\u002Flogin-action@\u003Creviewed-full-commit-sha>\n\n    - name: Deploy the immutable artifact\n      run: .\u002Fscripts\u002Fdeploy-approved-artifact.sh\n",[266,1040,1041,1048,1058,1068,1077,1086,1096,1103,1112,1122,1126,1133,1145,1154,1161,1170,1174,1185,1194,1198,1209],{"__ignoreMap":300},[304,1042,1043,1046],{"class":306,"line":307},[304,1044,1045],{"class":546},"deploy-production",[304,1047,567],{"class":336},[304,1049,1050,1053,1055],{"class":306,"line":322},[304,1051,1052],{"class":546},"  needs",[304,1054,269],{"class":336},[304,1056,1057],{"class":314}," verify\n",[304,1059,1060,1063,1065],{"class":306,"line":333},[304,1061,1062],{"class":546},"  if",[304,1064,269],{"class":336},[304,1066,1067],{"class":314}," github.event_name == 'push' && github.ref == 'refs\u002Fheads\u002Fmain'\n",[304,1069,1070,1073,1075],{"class":306,"line":351},[304,1071,1072],{"class":546},"  runs-on",[304,1074,269],{"class":336},[304,1076,691],{"class":314},[304,1078,1079,1082,1084],{"class":306,"line":370},[304,1080,1081],{"class":546},"  timeout-minutes",[304,1083,269],{"class":336},[304,1085,703],{"class":702},[304,1087,1088,1091,1093],{"class":306,"line":384},[304,1089,1090],{"class":546},"  environment",[304,1092,269],{"class":336},[304,1094,1095],{"class":314}," production\n",[304,1097,1098,1101],{"class":306,"line":600},[304,1099,1100],{"class":546},"  permissions",[304,1102,567],{"class":336},[304,1104,1105,1108,1110],{"class":306,"line":605},[304,1106,1107],{"class":546},"    contents",[304,1109,269],{"class":336},[304,1111,722],{"class":314},[304,1113,1114,1117,1119],{"class":306,"line":616},[304,1115,1116],{"class":546},"    id-token",[304,1118,269],{"class":336},[304,1120,1121],{"class":314}," write\n",[304,1123,1124],{"class":306,"line":621},[304,1125,558],{"emptyLinePlaceholder":557},[304,1127,1128,1131],{"class":306,"line":629},[304,1129,1130],{"class":546},"  steps",[304,1132,567],{"class":336},[304,1134,1135,1138,1140,1142],{"class":306,"line":640},[304,1136,1137],{"class":336},"    -",[304,1139,744],{"class":546},[304,1141,269],{"class":336},[304,1143,1144],{"class":314}," Check out the approved revision\n",[304,1146,1147,1150,1152],{"class":306,"line":651},[304,1148,1149],{"class":546},"      uses",[304,1151,269],{"class":336},[304,1153,760],{"class":314},[304,1155,1156,1159],{"class":306,"line":656},[304,1157,1158],{"class":546},"      with",[304,1160,567],{"class":336},[304,1162,1163,1166,1168],{"class":306,"line":664},[304,1164,1165],{"class":546},"        persist-credentials",[304,1167,269],{"class":336},[304,1169,779],{"class":563},[304,1171,1172],{"class":306,"line":672},[304,1173,558],{"emptyLinePlaceholder":557},[304,1175,1176,1178,1180,1182],{"class":306,"line":683},[304,1177,1137],{"class":336},[304,1179,744],{"class":546},[304,1181,269],{"class":336},[304,1183,1184],{"class":314}," Authenticate with short-lived cloud identity\n",[304,1186,1187,1189,1191],{"class":306,"line":694},[304,1188,1149],{"class":546},[304,1190,269],{"class":336},[304,1192,1193],{"class":314}," cloud-provider\u002Flogin-action@\u003Creviewed-full-commit-sha>\n",[304,1195,1196],{"class":306,"line":706},[304,1197,558],{"emptyLinePlaceholder":557},[304,1199,1200,1202,1204,1206],{"class":306,"line":714},[304,1201,1137],{"class":336},[304,1203,744],{"class":546},[304,1205,269],{"class":336},[304,1207,1208],{"class":314}," Deploy the immutable artifact\n",[304,1210,1211,1214,1216],{"class":306,"line":725},[304,1212,1213],{"class":546},"      run",[304,1215,269],{"class":336},[304,1217,1218],{"class":314}," .\u002Fscripts\u002Fdeploy-approved-artifact.sh\n",[262,1220,1221,1222,1225],{},"The cloud trust policy should constrain organization, repository, workflow, branch or protected environment, audience, and any reusable-workflow claims required by the provider. ",[266,1223,1224],{},"id-token: write"," permits requesting an OIDC token; the cloud policy decides what that identity can access.",[290,1227,1229],{"id":1228},"neutron-use-during-workflow-changes","Neutron use during workflow changes",[262,1231,1232],{},"Request delivery and language policy before editing:",[295,1234,1238],{"className":1235,"code":1236,"language":1237,"meta":300,"style":300},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n  \"nucleusId\": \"payments-service\",\n  \"scopeIds\": [\n    \"governance:team-code\",\n    \"delivery:github-actions\",\n    \"standards:typescript-javascript\",\n    \"repo:root\",\n    \"infra:cloudflare\",\n    \"tests:release\",\n    \"agent:copilot\"\n  ],\n  \"agentId\": \"agent:copilot\",\n  \"task\": \"Add provenance to the release workflow without broadening deployment permissions.\",\n  \"tokenBudget\": 1600\n}\n","json",[266,1239,1240,1245,1266,1280,1292,1302,1313,1324,1335,1346,1355,1360,1379,1399,1413],{"__ignoreMap":300},[304,1241,1242],{"class":306,"line":307},[304,1243,1244],{"class":336},"{\n",[304,1246,1247,1249,1252,1254,1256,1258,1261,1263],{"class":306,"line":322},[304,1248,337],{"class":336},[304,1250,398],{"class":1251},"spNyl",[304,1253,346],{"class":336},[304,1255,269],{"class":336},[304,1257,357],{"class":336},[304,1259,1260],{"class":314},"payments-service",[304,1262,346],{"class":336},[304,1264,1265],{"class":336},",\n",[304,1267,1268,1270,1273,1275,1277],{"class":306,"line":333},[304,1269,337],{"class":336},[304,1271,1272],{"class":1251},"scopeIds",[304,1274,346],{"class":336},[304,1276,269],{"class":336},[304,1278,1279],{"class":336}," [\n",[304,1281,1282,1285,1288,1290],{"class":306,"line":351},[304,1283,1284],{"class":336},"    \"",[304,1286,1287],{"class":314},"governance:team-code",[304,1289,346],{"class":336},[304,1291,1265],{"class":336},[304,1293,1294,1296,1298,1300],{"class":306,"line":370},[304,1295,1284],{"class":336},[304,1297,268],{"class":314},[304,1299,346],{"class":336},[304,1301,1265],{"class":336},[304,1303,1304,1306,1309,1311],{"class":306,"line":384},[304,1305,1284],{"class":336},[304,1307,1308],{"class":314},"standards:typescript-javascript",[304,1310,346],{"class":336},[304,1312,1265],{"class":336},[304,1314,1315,1317,1320,1322],{"class":306,"line":600},[304,1316,1284],{"class":336},[304,1318,1319],{"class":314},"repo:root",[304,1321,346],{"class":336},[304,1323,1265],{"class":336},[304,1325,1326,1328,1331,1333],{"class":306,"line":605},[304,1327,1284],{"class":336},[304,1329,1330],{"class":314},"infra:cloudflare",[304,1332,346],{"class":336},[304,1334,1265],{"class":336},[304,1336,1337,1339,1342,1344],{"class":306,"line":616},[304,1338,1284],{"class":336},[304,1340,1341],{"class":314},"tests:release",[304,1343,346],{"class":336},[304,1345,1265],{"class":336},[304,1347,1348,1350,1353],{"class":306,"line":621},[304,1349,1284],{"class":336},[304,1351,1352],{"class":314},"agent:copilot",[304,1354,411],{"class":336},[304,1356,1357],{"class":306,"line":629},[304,1358,1359],{"class":336},"  ],\n",[304,1361,1362,1364,1367,1369,1371,1373,1375,1377],{"class":306,"line":640},[304,1363,337],{"class":336},[304,1365,1366],{"class":1251},"agentId",[304,1368,346],{"class":336},[304,1370,269],{"class":336},[304,1372,357],{"class":336},[304,1374,1352],{"class":314},[304,1376,346],{"class":336},[304,1378,1265],{"class":336},[304,1380,1381,1383,1386,1388,1390,1392,1395,1397],{"class":306,"line":651},[304,1382,337],{"class":336},[304,1384,1385],{"class":1251},"task",[304,1387,346],{"class":336},[304,1389,269],{"class":336},[304,1391,357],{"class":336},[304,1393,1394],{"class":314},"Add provenance to the release workflow without broadening deployment permissions.",[304,1396,346],{"class":336},[304,1398,1265],{"class":336},[304,1400,1401,1403,1406,1408,1410],{"class":306,"line":656},[304,1402,337],{"class":336},[304,1404,1405],{"class":1251},"tokenBudget",[304,1407,346],{"class":336},[304,1409,269],{"class":336},[304,1411,1412],{"class":702}," 1600\n",[304,1414,1415],{"class":306,"line":664},[304,1416,1417],{"class":336},"}\n",[262,1419,1420],{},"The review skill checks:",[1422,1423,1424,1427,1430,1433,1436,1439,1442],"ol",{},[274,1425,1426],{},"triggers and actor trust",[274,1428,1429],{},"effective workflow and job permissions",[274,1431,1432],{},"expressions entering shell, paths, cache keys, artifacts, matrices, and action inputs",[274,1434,1435],{},"action provenance and immutable pins",[274,1437,1438],{},"secrets, OIDC claims, environments, approvals, concurrency, and timeouts",[274,1440,1441],{},"required language, dependency, security, build, and release checks",[274,1443,1444],{},"artifact integrity, retention, attestations, and rollback evidence",[262,1446,1447],{},"It returns findings before a summary and separates repository-file evidence from GitHub settings that require administrator verification.",[290,1449,1451],{"id":1450},"protect-the-merge-boundary","Protect the merge boundary",[262,1453,1454],{},"Configure repository or organization rulesets so required checks cannot be bypassed by an agent-authored summary. At minimum, consider:",[271,1456,1457,1460,1463,1466,1469,1472,1475],{},[274,1458,1459],{},"required pull requests and approving reviews",[274,1461,1462],{},"code-owner review for workflows, security, infrastructure, and release paths",[274,1464,1465],{},"required status checks with stable unique job names",[274,1467,1468],{},"dismissal or reapproval after material changes",[274,1470,1471],{},"restricted force pushes, deletions, tags, and release branches",[274,1473,1474],{},"environment reviewers and deployment branch restrictions",[274,1476,1477],{},"signed commits or attestations where policy requires them",[262,1479,1480],{},"These settings live outside workflow YAML. The coding agent must not claim they are enabled unless it inspected the authorized repository settings or received current administrator evidence.",[290,1482,1484],{"id":1483},"source-anchors","Source anchors",[271,1486,1487,1496,1503,1510,1517,1524],{},[274,1488,1489],{},[1490,1491,1495],"a",{"href":1492,"rel":1493},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Fhow-tos\u002Fsecurity-for-github-actions\u002Fsecurity-guides\u002Fsecurity-hardening-for-github-actions",[1494],"nofollow","GitHub Actions security hardening",[274,1497,1498],{},[1490,1499,1502],{"href":1500,"rel":1501},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Freference\u002Fworkflows-and-actions\u002Fworkflow-syntax",[1494],"Workflow syntax",[274,1504,1505],{},[1490,1506,1509],{"href":1507,"rel":1508},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Fconcepts\u002Fsecurity\u002Fopenid-connect",[1494],"OpenID Connect",[274,1511,1512],{},[1490,1513,1516],{"href":1514,"rel":1515},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Fhow-tos\u002Freuse-automations\u002Freuse-workflows",[1494],"Reusable workflows",[274,1518,1519],{},[1490,1520,1523],{"href":1521,"rel":1522},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcode-security\u002Ftutorials\u002Fsecure-your-dependencies\u002Fcustomize-dependency-review-action",[1494],"Dependency review",[274,1525,1526],{},[1490,1527,1530],{"href":1528,"rel":1529},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Factions\u002Fconcepts\u002Fsecurity\u002Fartifact-attestations",[1494],"Artifact attestations",[1532,1533,1534],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sbssI, html code.shiki .sbssI{--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":300,"searchDepth":322,"depth":322,"links":1536},[1537,1538,1544,1545,1546,1547,1548],{"id":292,"depth":322,"text":293},{"id":442,"depth":322,"text":443,"children":1539},[1540,1541,1542,1543],{"id":447,"depth":333,"text":448},{"id":469,"depth":333,"text":470},{"id":494,"depth":333,"text":495},{"id":512,"depth":333,"text":513},{"id":530,"depth":322,"text":531},{"id":1031,"depth":322,"text":1032},{"id":1228,"depth":322,"text":1229},{"id":1450,"depth":322,"text":1451},{"id":1483,"depth":322,"text":1484},"Install and apply secure GitHub Actions standards, review skills, and delivery knowledge.","md",{},{"title":155,"description":1549},"hT6eCMLS0zbT9PyXcA0oC5D88o9Du3ItPlpcIc0-hrE",[1555,1556],{"title":151,"path":152,"stem":153,"children":-1},{"title":159,"path":160,"stem":161,"children":-1},1786883755931]