GitHub Repository Guard Guardrails

Pull request, merge, and protected-push evidence for a repository

Python + TS

GitHub Repository Guard is a project-level target rather than a runtime framework: it writes a workflow that evaluates pull requests, merges, and protected pushes against an OAP passport. The installer dispatches it before framework detection, so it is set up per repository rather than per agent runtime.

GitHub Repository Guard Repo Integration Docs

Quick Start

1. Install guardrail & create passport

setup

npx @aporthq/aport-agent-guardrails github

2. Configure the integration

code

# Run from the repository root
npx @aporthq/aport-agent-guardrails github

Test the authorization boundary

Installer target: github. Aliases: none; use the target ID.

GitHub Repository Guard setup

npx @aporthq/aport-agent-guardrails github

Denied-action example

Request pr.merge using a suspended test passport.

Expected hosted policy result: deny. Evidence-only mode reports findings without blocking the merge; enforce the hosted check through branch protection.

Expected policy result, illustrative

{
  "policy_id": "code.repository.merge.v1",
  "allow": false,
  "reason": "oap.passport_suspended"
}

Read the guardrail skill Inspect the framework passport preset Review GitHub Repository Guard before enforcement

How It Works

Passport

Your agent gets an OAP passport declaring its identity, capabilities, and operational limits.

Evaluate

Before every tool call, the guardrail evaluates it against the passport's policy. Locally or via hosted API.

Decision

Allow or deny with structured OAP reason codes. Signed decisions create an auditable trail.

Frequently Asked Questions

Is this a framework or a repository setting?

A repository setting. The installer handles `github` before it detects or prompts for a runtime framework, so it is set up once per repository and is independent of whichever agent framework you run.

Does it block merges straight away?

No. The default auto mode reports on pull requests and exits 0, so it will not block merges until you opt into hosted mode.

Ready to secure your GitHub Repository Guard agents?

Review the setup command and denied-action check before enforcing policy.

Install my guardrail See Team Pricing

Start free for local or individual setup. Upgrade to Team for hosted org audit, signed decisions, GitHub guardrails, and shared enforcement across your team.