GitHub Actions Evidence

Treat CI as an evidence producer

GitHub Actions can produce stronger evidence than an agent-authored success message because the workflow run, commit, check result, and artifact are independently addressable. Midfleet can record or require that evidence on a controlled completion path; GitHub remains authoritative for what the check actually ran.

Publish a workflow artifact from server-side automation

Register an immutable artifact schema first. Give the GitHub Actions secret a workspace API key scoped to workflow-artifacts:write for the intended project. Publish only after the job has produced the commit SHA, run URL, conclusion, and any test summary required by the schema.

curl -fsS -X POST \
  "$MIDFLEET_API/api/v1/projects/$MIDFLEET_PROJECT_ID/workflow/invocations/$MIDFLEET_INVOCATION_ID/artifact" \
  -H "X-API-Key: $MIDFLEET_API_KEY" \
  -H "Content-Type: application/json" \
  --data @midfleet-evidence.json

Include enough provenance to verify the result

• Repository and commit SHA.
• GitHub Actions run URL and immutable run ID.
• Workflow name, job name, conclusion, and observed timestamp.
• Test or check summary required by the registered artifact schema.
• Known limitations, skipped checks, or partial coverage.

Use the maintained example

Start from the GitHub Actions evidence example. It builds the JSON payload without printing secrets and keeps publication separate from test execution.