feat: add reusable ProofPath Deploy Guard action

[safal207]

What changed

Turns the signed Deploy Guard demo from #206 into a reusable GitHub Action that another repository can place immediately before a production deployment boundary.

The integration adds:

• deploy-guard/action.yml as a dedicated composite Action without replacing the existing root metrics Action;
• a dependency-free, fail-closed Action wrapper;
• enforce and observe adoption modes;
• machine-readable decision, reason, root, assurance, transition, and certificate outputs;
• a human-readable GitHub job summary;
• a copyable downstream consumer workflow;
• commit-pinning and evidence-retention guidance;
• 10 integration tests and 11 static security tests;
• a real local-Action conformance workflow.

Modes

enforce
  ACCEPT -> continue
  HOLD / BLOCK / CHALLENGE -> fail the step

observe
  complete valid certificate -> report without failing
  malformed or incomplete certificate -> fail closed

Observe mode allows a design partner to measure readiness before turning the gate into a mandatory release control. It never converts malformed evidence into a successful check.

Outputs

The Action exports:

decision
primary-reason-code
clearance-root
policy-root
evidence-root
execution-allowed
authority-granted
permitted-next-transition
assurance-level
witness-level
coverage
certificate-path

authority-granted must remain false. The Action evaluates existing authority; it does not create it.

Security boundary

The wrapper:

• receives inputs through environment variables and argument-list elements, not shell interpolation;
• never uses shell=True, eval, exec, or os.system;
• constrains policy, evidence, and certificate paths to GITHUB_WORKSPACE;
• rejects multiline and NUL-containing values;
• checks decision/exit-code agreement;
• checks certificate validity, three roots, next transition, assurance labels, and authority boundary;
• emits only controlled single-line outputs;
• never performs a deployment, merge, IAM change, or cloud operation.

The conformance workflow has read-only repository permission and no signing permission.

Consumer rule

Production consumers should pin the Action to a reviewed full 40-character commit SHA rather than main, retain the certificate even on failure, and keep the actual deployment in a separate step guarded by decision == 'ACCEPT'.

Honest assurance boundary

Assurance: POLICY_VERIFIED
Witnesses: SINGLE_WORKFLOW_REFERENCE
Coverage: NOT_FINANCIALLY_COVERED
Deployment performed: false
Authority granted: false

Stacked PR

Base: agent/proofpath-deploy-guard-v0.1 / #206

No merge is performed by this PR.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ac1496c9-625b-49b4-95f3-2f68a05ec52e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Validation complete

Final source head: bb2aec89b3d2b8e9efd5a1996e6a2665aa53af3a

Current pull-request workflow subject: f74870474ef8a1ff5df6438a55b66151392e6f50

The conformance manifest records these as separate provenance fields:

source_sha
workflow_subject_sha

Reusable Action conformance

ProofPath Deploy Guard Action run #3 (30715702450) passed:

• 10 integration tests;
• 11 static security tests;
• real local composite-Action execution with uses: ./deploy-guard;
• ACCEPT in enforce mode continued successfully;
• HOLD, BLOCK, and CHALLENGE in observe mode emitted complete certificates without failing;
• HOLD in enforce mode emitted its certificate and then failed the Action with exit code 2;
• step outputs remained available and exactly matched all four decisions;
• the Action used read-only repository permission and no signing permission;
• no deployment, merge, IAM, or cloud command was executed.

Verified clearance roots:

ACCEPT    sha256:31a5e449aab0d91df14cb7a1109890a0355733dfe3ea94b1a3735a7519d40236
HOLD      sha256:f9a16eb904860b9b3cd20820ad74702c7c61f3583ea3cc24e9b578f4567e30dd
BLOCK     sha256:5b8235e9549f7ffd26c41c68f5f5c88320b47f6be27d4d9ec9b4734149a15084
CHALLENGE sha256:4d86aa41ee438bb1a7bcedcf28eb1031af22cfad7d8a162d7c0e789435f60cc8

Action evidence artifact:

• name: proofpath-deploy-guard-action-30715702450
• artifact ID: 8823257085
• size: 14605 bytes
• SHA-256: 4b7a63046f03e27878edbdf0540476fef8b77438df8c0997c943e6818a90b448
• expires: 2026-08-15T19:52:02Z

Parent Deploy Guard regression

ProofPath Deploy Guard run #4 (30715702445) passed:

• 32 focused verifier and workflow-boundary tests;
• all four decision scenarios;
• deterministic clearance-root verification;
• keyless attestation of the ACCEPT certificate and demo manifest;
• signed evidence artifact upload.

Signed demo artifact:

• name: proofpath-deploy-guard-30715702445
• artifact ID: 8823257575
• SHA-256: 60e2371f84b3bab0a13bf305546e0beab3fc35c5df7aa3ff25af4e0526b64e27
• expires: 2026-08-15T19:52:05Z

Repository regression

Rust run #291 (30715702443) passed:

• formatting;
• clippy;
• workspace tests;
• Compute Witness;
• action-boundary metrics;
• existing reusable root Action;
• Personal Agent Guard;
• Agent Payment Guard.

First-run correction

The initial Action run failed because one malformed-input test expected a narrower error string than the valid fail-closed result actually produced. The runtime already returned exit code 1 and rejected the incomplete certificate. Commit d619eec827eee21ff048c005080c592fd1b54c9d aligned the assertion with the observed contract; no permissive runtime behavior was introduced.

Honest product boundary remains:

Assurance: POLICY_VERIFIED
Witnesses: SINGLE_WORKFLOW_REFERENCE
Coverage: NOT_FINANCIALLY_COVERED
Deployment performed: false
Authority granted: false

No merge has been performed.