npx @aporthq/aport-agent-guardrails github

# Review and commit the generated workflow.
git diff -- .github/workflows/aport-guard.yml
git add .github/workflows/aport-guard.yml
git commit -m "Add APort Repository Guard"
git push

# No APORT_AGENT_ID or APORT_API_KEY secret is required for mode: auto.
# The Action requests a GitHub OIDC token and APort binds the hosted passport to:
# - repository / repository_id
# - event type and runner evidence

permissions:
  id-token: write
  contents: read
  pull-requests: read

# Store the passport ID as a GitHub Actions variable.
gh variable set APORT_GITHUB_AGENT_ID --body "ap_your_repo_passport_id"

# Store the APort API key as a GitHub Actions secret.
gh secret set APORT_API_KEY

# Then use managed hosted mode in .github/workflows/aport-guard.yml:
- uses: aporthq/policy-verify-action@v1
  with:
    mode: hosted
    agent-id: ${{ vars.APORT_GITHUB_AGENT_ID }}
    api-key: ${{ secrets.APORT_API_KEY }}

# The API key is sent as X-API-Key only to APort Verify.
# GitHub OIDC still proves the workflow is running for the bound repository.
# External fork PRs are detected by the Action and continue through
# the no-secret hosted OIDC path because GitHub withholds secrets there.

# First enable blocking hosted enforcement in .github/workflows/aport-guard.yml:
# - uses: aporthq/policy-verify-action@v1
#   with:
#     mode: hosted
#
# Then create a test PR that should be denied in hosted enforcement.
# 1. Create a branch with a workflow permission escalation
git checkout -b test-policy-violation
mkdir -p .github/workflows
cat > .github/workflows/aport-policy-test.yml <<'YAML'
name: APort policy violation test
on: pull_request
permissions: write-all
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - run: echo "this workflow requests broad repository permissions"
YAML
git add .github/workflows/aport-policy-test.yml
git commit -m "Add workflow permission escalation"
git push origin test-policy-violation

# 2. Create PR via GitHub CLI
gh pr create --title "Test: Policy violation" --body "Testing APort policy enforcement"

# Expected result in hosted mode with branch protection:
# the PR check fails with a reason like:
# "❌ APort Verification Failed
#  Reason: OAP.REPO.WORKFLOW_PERMISSION_ESCALATION
#  Workflow write permissions were introduced or expanded."
#
# In mode: auto, use the same PR as a report-only smoke test; do not expect
# branch protection to block unless hosted enforcement is enabled.

# 3. Check the workflow logs for detailed policy context
# Go to Actions tab > APort Repository Guard > View logs

# .aport/policy.yaml
version: oap-github-policy/1

repository:
  protected_paths:
    - .github/workflows/**
    - package.json
    - pnpm-lock.yaml
    - functions/api/verify/**
    - policies/**

github:
  require_pinned_actions: true