Give every AI-assisted PR a policy checkpoint.
APort runs in GitHub Actions, binds repository evidence through GitHub OIDC, and evaluates AI-assisted changes against OAP policy. Start in report-only mode; use hosted enforcement with branch protection when you want failing decisions to block.
npx @aporthq/aport-agent-guardrails githubThe command writes a reviewable workflow. If your organization blocks CLI initializers, use the manual YAML in the quickstart.
Built to share
Every run produces a branded security receipt.
APort writes a GitHub job summary with Porter, deterministic status, structural findings, decision metadata, and a copyable README badge. Teams can start report-only, then make the check required when they are ready to enforce.
[](https://github.com/OWNER/REPO/actions/workflows/aport-guard.yml)Free mode has no APort key
`mode: auto` uses GitHub OIDC so the workflow does not need a broad APort API key stored in repository secrets. Managed org audit adds a scoped secret only when you opt in.
Evidence before merge
The Action collects repository, PR, path, workflow, attribution, and release evidence before calling APort Verify.
Signed OAP decisions
Hosted enforcement returns signed allow or deny decisions with policy ID, reasons, key ID, and verification metadata for audit.
What it checks
Start with high-signal repository controls.
APort does not replace branch protection, secret scanning, dependency scanning, or review. It adds an action authorization layer for agentic repository work. Protected paths are highlighted for review and policy context; concrete high-risk findings are what should fail the workflow.
Roll out in the mode that matches your risk.
evidence-only
Collect findings first. Useful when a team wants visibility without blocking merges yet.
auto
Use GitHub OIDC to issue or reuse a hosted repository passport. No APort secret is required, which keeps open-source setup low-friction.
hosted
Use an explicit hosted passport and API key for branch-protection-ready enforcement and customer-owned org audit.
local-json
Evaluate a checked-in or generated local passport file where hosted verification is not desired.
Managed hosted audit
Persist decisions under your APort org.
Use the free OIDC path to start. When a team needs org-level audit, configure a GitHub-bound passport ID as a variable and an APort API key as a secret. The Action still requires GitHub OIDC before APort signs or stores the decision.
- uses: aporthq/policy-verify-action@v1
with:
mode: hosted
agent-id: ${{ vars.APORT_GITHUB_AGENT_ID }}
api-key: ${{ secrets.APORT_API_KEY }}
protected-paths: ".github/workflows/**,.aport/**,package.json"
# The Action detects external fork PRs and uses the no-secret OIDC path.
# Same-repo PRs and pushes persist decisions under your APort org.Free visibility first. Enforcement when the signal is clear.
Use report-only/evidence modes to understand your repository patterns, then upgrade to Team or Enterprise for hosted enforcement, organization audit, and rollout support.