Give every Code Contribution a policy checkpoint.
APort runs in GitHub Actions, binds repository evidence through GitHub OIDC, and evaluates AI-assisted changes against OAP policy. Start in report-only mode or make the check required when you want failing decisions to block.
Add the guard
Agent-first setup, human-reviewable change.
Give the instruction to the agent that owns the repo, open the guided page yourself, or run the CLI from the repository root.
Recommended
Let my agent prepare GitHub Guard.
Best for teams already using Claude, Codex, or Cursor to open pull requests.
set up APort GitHub Repository Guard for this repo — https://aport.io/skillCopy this into the agent that already has access to your repo or runtime environment. Require a diff before enforcement or secrets are enabled.
Built to share
Every run produces a branded security receipt.
APort writes a GitHub job summary with Porter, deterministic status, structural findings, decision metadata, and a copyable README badge. Teams can start report-only, then make the check required when they are ready to enforce. Paid plans add org-owned audit and rollout support.
[](https://github.com/OWNER/REPO/actions/workflows/aport-guard.yml)Free mode has no APort key
`mode: auto` uses GitHub OIDC so the workflow does not need a broad APort API key stored in repository secrets. Managed org audit adds a scoped secret only when you opt in.
Evidence before merge
The Action collects repository, PR, path, workflow, attribution, and release evidence before calling APort Verify.
Signed OAP decisions
Hosted enforcement returns signed allow or deny decisions with policy ID, reasons, key ID, and verification metadata for audit.
What it checks
Start with high-signal repository controls.
APort does not replace branch protection, secret scanning, dependency scanning, or review. It adds an action authorization layer for agentic repository work. Protected paths are highlighted for review and policy context; concrete high-risk findings are what should fail the workflow.
Roll out in the mode that matches your risk.
evidence-only
Collect findings first. Useful when a team wants visibility without blocking merges yet.
auto
Use GitHub OIDC to issue or reuse a hosted repository passport. No APort secret is required, which keeps open-source setup low-friction.
hosted
Use an explicit hosted passport and API key for branch-protection-ready enforcement and customer-owned org audit.
local-json
Evaluate a checked-in or generated local passport file where hosted verification is not desired.
Managed hosted audit
Persist decisions under your APort org.
Use the free OIDC path to start. When a team needs org-level audit, configure a GitHub-bound passport ID as a variable and an APort API key as a secret. The Action still requires GitHub OIDC before APort signs or stores the decision.
- uses: aporthq/policy-verify-action@v1
with:
mode: hosted
agent-id: ${{ vars.APORT_GITHUB_AGENT_ID }}
api-key: ${{ secrets.APORT_API_KEY }}
protected-paths: ".github/workflows/**,.aport/**,package.json"
# The Action detects external fork PRs and uses the no-secret OIDC path.
# Same-repo PRs and pushes persist decisions under your APort org.Free visibility first. Free enforcement when the signal is clear.
Use report-only/evidence modes to understand your repository patterns, then make APort required in branch protection. Upgrade when you need org-owned audit, team controls, and rollout support.