Govern v2: the Marketplace address delegates to the gate in decionis/agent-safe-pipeline

[ocularminds]

Why

The gate now lives in decionis/agent-safe-pipeline under govern/, the reference implementation of the Decionis execution contract: one Go binary for GitHub Actions, GitLab CI, Jenkins and any other runner that captures a step as an execution intent, asks Decionis through enforce-and-bind, runs the command only on a claimed grant, and finalizes the outcome into the Decision Dossier — no local policy engine, tenant-id in place of org-id and workflow-key. This repository stays the Marketplace address.

What changed

• action.yml keeps the listing's name, Decionis Action Gate (so marketplace/actions/decionis-action-gate stays valid), carries the v2 inputs and outputs generated from the gate's own action.yml, and delegates every input and output to decionis/agent-safe-pipeline/govern@a29fb021 (master, feat(govern): the action runs the bytes its commit names, `govern ini... agent-safe-pipeline#245). The pinned action downloads the release binary its commit names and verifies its SHA-256 before running, or builds the same bytes from the commit when no archive exists yet. To move to a newer gate, move the pin.
• The v1 node20 action (src/, its tests, the onboarding installer, the execution-grant recipes) leaves main; it stays where its tags point (v1.9.3 the last) and uses: decionis/govern@v1 keeps resolving to it.
• examples/ are copies of the gate's v2 recipes; README, llms.txt, SUPPORT.md and SECURITY.md say where the gate lives, what changed from v1, and where to report what. The api-key description carries no expression (f7bc51d's lesson).
• The repository's About and topics are already updated to the v2 capabilities.

After merging

Tag v2.0.0 on the merge commit; advance-major-tag points v2 at it, and uses: decionis/govern@v2 resolves.

🤖 Generated with Claude Code