ARCIFACT GATE It computes what a green required check PROVES, and tells you when a pull request changes that. Install: https://github.com/apps/arcifact-gate PERMISSIONS IT ASKS FOR, AND WHY contents: read to read your workflow files checks: write to post its own check run. This is the same permission our own analysis calls the ability to clear any failing gate, because a later check run of a name supersedes an earlier one. We hold it and cannot work without it. What makes it safe here is that this App NEVER ASKS TO BE A REQUIRED CHECK, so nothing depends on the run it posts and superseding it changes no merge decision. If you ever make it required, that stops being true, and we would rather you did not. pull_requests: read to see which commits to compare actions: read to observe whether checks actually ran WHAT IT WILL DO, AND WHAT ENFORCES THAT It never blocks a merge. the App does not ask to be a required check. Promotion is the repository owner's decision, taken after watching it be right. enforced by: consumer posts to its own check run and never modifies a ruleset It speaks only when meaning CHANGES. a verdict that persists is not repeated. A chronically undecided gate is spoken to once, not on every touch. enforced by: transition semantics keyed on content, tested against absorption It never reports green through its own failure. if the analysis errors, the check completes NEUTRAL with the reason. A green we cannot support is the failure this product detects. enforced by: every error path is asserted to complete neutral It never publishes a finding about a repository whose owner did not ask. findings about your repository go to your check runs and your pages. Nothing is posted publicly, ranked, or shared. enforced by: the disclosure ledger gates every external contact When it is wrong, it says so and names the defect. a claim produced by an instrument later found defective is recalled, not quietly corrected. enforced by: the revision protocol, with recall requiring a named defect EVERY SENTENCE IT CAN EVER SAY (7) branch_unprotected needs DERIVED evidence cannot_fail needs DERIVED evidence no_required_check needs DERIVED evidence observed_green needs OBSERVED evidence proves_nothing needs DERIVED evidence proves_only needs DERIVED evidence undecided needs UNKNOWN evidence installing consents to AT MOST these sentences. The list is generated from the grammar, not written here: if a form is added to the product it appears on this page, and if the page says the product will never say something, that is because no form exists that says it. read forward this is consent, at most these sentences. Read backward it is liveness, at least these sentences, each demonstrably utterable in every run. The suite proves the second while this page promises the first. WHAT IS NOT PROMISED no uptime, no support response time, no accuracy rate. Every line here is generated from a gate or is a policy with a named mechanism. A promise with neither has no place on a page a stranger acts on. REMOVING IT uninstall from your organisation's settings. Nothing is retained, and one line on why you removed it is worth more to us than the install was. WHAT IT COSTS nothing to install, and nothing to run on a public repository, permanently. on private repositories the first five committers are free on every plan, and above that it is priced per committer with the rate falling as the team grows. Rates: https://arcifact.io/pricing installing does not subscribe you to anything and does not ask for a card. The App works before you pay. SEE IT FIRST, WITH NO INSTALL /r// what your checks prove today /r///pull/N why a pull request is stuck /semantics what GitHub Actions actually does