GitHub Actions connects to Provely through the CLI, the REST API. The agent does the action. Provely verifies the outcome and signs a receipt. GitHub Actions never holds the verifier credentials.

A person verified the GitHub Actions capabilities on 2026-09-10. Agent products change monthly. Re-verify before you build.

Source: integration profile github-actions · retrieved 2026-09-10

Which surfaces does GitHub Actions use?

SurfaceSupportDetail
MCP serverNot supportedtransport
CLISupportedRuns through the shell tool of the agent.
SDKNot supported
REST APISupportedAny HTTP call reaches the control plane.

Which guidance files does GitHub Actions read?

Provely ships one Agent Skill for this host, so the agent knows to verify an outcome before it claims done. The renderer writes prompt fragment from one source. A new agent needs a profile, not core code.

Explain: each file, its path and its write mode
FormatPathMode
review gate.github/workflows/provely-review-gate.ymlfragment
CI gate workflow.provely/ci/github-actions.ymlfragment
prompt fragmentprovely/prompt-fragment.mdfragment

How is a false completion claim blocked?

Guidance asks. A hook and the CI gate enforce. A host with neither still receives the verdict, and a person reads it before the work ships.

Explain: what each control does on this host
EnforcementSupportDetail
Advisory guidanceSupportedThe instruction files state the rules for every agent.
Lifecycle hooksNot supportedNo hook events stated.
CI gateSupportedprovely verify --wait fails the pipeline unless the verdict is VERIFIED.

How do I connect GitHub Actions?

Connect GitHub Actions to Provely

  1. Install the CLI.Run npx provely --version, or download the static binary.
  2. Write the guidance files.Run provely init --agent github-actions. It writes .github/workflows/provely-review-gate.yml (fragment), .provely/ci/github-actions.yml (fragment), provely/prompt-fragment.md (fragment). The guidance carries one rule: a successful tool call is not completion.
  3. Add the CI gate.Run provely verify --wait <duration> in the pipeline. The step fails unless the verdict is VERIFIED. Exit codes: 0 VERIFIED, 2 PENDING, 3 FAILED, 4 CONTRADICTED, 5 UNVERIFIABLE, 1 error.
  4. Report the verdict exactly as returned.VERIFIED: "The action is verified complete. Receipt: <id>." PENDING: "The action is accepted but not yet verified. Operation: <id>."

What else does the profile state?

  • Verified 2026-09-10: a reusable workflow declares on: workflow_call with inputs and secrets. A caller passes each secret by name, or it passes secrets: inherit. Source: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows.
  • Checked 2026-09-10: the same page does not state whether a job-level permissions block inside a called workflow applies. The token of the caller caps every permission, so a caller that grants less wins.
  • The review gate runs provely scan --diff <base sha> --submit. It exits 0 when every item is covered or confirmed, 10 when an item needs a statement, and 1 on a transport error.
  • A re-run reads the review id from the pull request comment and calls provely review status. A person signs off once, and the check goes green with no second scan.
  • The gate finds the side effects that cli/rules/scanner-rules.yaml names. A call that the rule set does not name is not found. Extend that file, not the workflow.
  • GitHub Actions publishes no version number for the workflow syntax, so this profile names the Provely API range. Read docs/review-gate.md before you install the gate.

GitHub Actions keeps its action credentials, and no surface returns the verifier credentials to it. Read the credential boundary. An operation outlives the session that opened it. Read the API reference.

Which host versions does the profile cover?

>=1.0.0. The integrations team last verified the profile with no agent host: the range names the Provely REST API /v1 (1.0.0) on 2026-09-10.