Governa

Developers · CI/CD

No evaluation, no promotion.

Add one step to your pipeline. Governa checks the agent's latest evaluation, approval state and incident re-certification, then returns a signed decision. A blocked decision fails the build and is written to your audit ledger.

Recent passing evaluation
Pass rate at or above threshold
High-risk approval completed
No open re-certification

GitHub Actions

# .github/workflows/deploy.yml
jobs:
  governance-gate:
    runs-on: ubuntu-latest
    steps:
      - name: Governa promotion check
        env:
          GOVERNA_API_KEY: ${{ secrets.GOVERNA_API_KEY }}
        run: |
          curl -sf -X POST https://governahq.org/api/public/governance/promotion-check \
            -H "Authorization: Bearer $GOVERNA_API_KEY" \
            -H "Content-Type: application/json" \
            -d '{"agent_name":"claims-triage","min_pass_rate":85,"max_age_hours":72}' \
            | tee decision.json | jq -e '.allowed == true'
  deploy:
    needs: governance-gate
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh

GitLab CI

# .gitlab-ci.yml
governance_gate:
  stage: test
  image: alpine:3.20
  before_script: [ "apk add --no-cache curl jq" ]
  script:
    - curl -sf -X POST https://governahq.org/api/public/governance/promotion-check \
        -H "Authorization: Bearer $GOVERNA_API_KEY" \
        -H "Content-Type: application/json" \
        -d '{"agent_name":"claims-triage","min_pass_rate":85,"max_age_hours":72}' \
        | tee decision.json | jq -e '.allowed == true'

deploy:
  stage: deploy
  needs: [governance_gate]
  script: [ ./deploy.sh ]

Azure DevOps

# azure-pipelines.yml
stages:
  - stage: Governance
    jobs:
      - job: PromotionCheck
        steps:
          - bash: |
              curl -sf -X POST https://governahq.org/api/public/governance/promotion-check \
                -H "Authorization: Bearer $GOVERNA_API_KEY" \
                -H "Content-Type: application/json" \
                -d '{"agent_name":"claims-triage","min_pass_rate":85,"max_age_hours":72}' \
                | tee decision.json | jq -e '.allowed == true'
            env:
              GOVERNA_API_KEY: $(GOVERNA_API_KEY)
  - stage: Deploy
    dependsOn: Governance
    jobs:
      - job: Release
        steps: [ { script: ./deploy.sh } ]

Shell / curl

curl -sf -X POST https://governahq.org/api/public/governance/promotion-check \
  -H "Authorization: Bearer $GOVERNA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"agent_name":"claims-triage","min_pass_rate":85,"max_age_hours":72}' \
  | tee decision.json | jq -e '.allowed == true'

REST response

{
  "allowed": false,
  "reason": "pass_rate_below_threshold",
  "event": "evaluation.failed",
  "evaluation_id": "6f1c…",
  "agent_id": "a92e…",
  "policy": "no-eval-no-promote/v1",
  "required_threshold": 85,
  "actual_threshold": 81.5,
  "evaluation_age": 3.25,
  "timestamp": "2026-10-14T16:20:00.000Z",
  "response_sha256": "…",
  "signature": "…",
  "signature_alg": "HMAC-SHA256"
}

Events

Each decision records one of: promotion.allowed, promotion.blocked, evaluation.failed, approval.required. Incident and policy events (incident.created, policy.violation, agent.high_risk) are recorded by the portal.

Create a key with the governance scope in Portal → Admin → Ingestion keys. Full schema in the API reference.