govern

# Decionis Govern (decionis/govern)

> GitHub Action, the Marketplace address of Govern: one Decionis verdict before a workflow step runs — a deploy, a migration, an infrastructure change, a release, an agent's action — with a signed Decision Dossier of it. The step becomes an execution intent, Decionis decides on exactly that intent, the command runs only on an ALLOW whose single-use grant the step claimed first, and the outcome is finalized into the dossier. Nothing is decided locally.

Quickstart:

- Add a workflow step: `uses: decionis/govern@v2` with `api-key` (a secret), `tenant-id` (a variable), `action`, and `run` (the command the verdict gates).
- `mode: shadow` starts the command at once and records the verdict beside it; it never fails a build.
- The gate is one Go binary for GitHub Actions, GitLab CI, Jenkins and any runner; its source, tests and releases are in decionis/agent-safe-pipeline under govern/.

Key inputs: `api-key`, `tenant-id`, `mode` (enforce | shadow), `action`, `resource`, `payload`, `environment`, `run`, `fail-on`, `escalation` (managed), `approver`, `approver-role`, `policy-file`, `comment`.

Key outputs: `decision`, `decision-id`, `dossier-id`, `verify-url`, `intent-hash`, `reason-codes`, `policy-version`, `executed`, `claimed`, `outcome`, `finalization`, `badge-markdown`.

## Docs

- [The gate's README](https://github.com/decionis/agent-safe-pipeline/blob/master/govern/README.md): every setting, output, exit code and runner surface
- [Govern, the workflow gate](https://github.com/decionis/agent-safe-pipeline/blob/master/docs/govern.md): what one governed step is, holding a step for a person, what the record shows
- [Quickstart](https://decionis.com/quickstart?source=github_action): a workspace and a key in minutes
- [Decision Dossier verification](https://decionis.com/verify/decision-dossiers): verify a signed dossier, including offline