Block a pull request on a real posture regression
The cmdash Posture Gate action runs your organization’s CI-gate check — score-drop, control-regression, expired-exception — against your live cmdash data, right in the pull request, before a regression reaches main.
What it checks
Score-drop
A maturity rollup fell more than the threshold vs. its previous snapshot.
Control-regression
A control moved backward in status (e.g. IMPLEMENTED → AT_RISK) within the lookback window.
Expired-exception
An ACTIVE exception is past its expiresAt.
Every failure cites the specific data behind it — which model and score, which control, which exception — as its own annotation on the run, never a bare “FAIL”.
Add it to a workflow
Create an API key with the gate:read permission (Settings → API Keys), store it as a repository or organization secret, then add this job:
name: cmdash posture gate
on:
pull_request:
push:
branches: [main]
jobs:
posture-gate:
runs-on: ubuntu-latest
steps:
# No `v1` tag exists yet (see MARKETPLACE.md) — pin to `@main`, then to
# a specific commit SHA once you’ve reviewed what you’re running:
# `uses: bgovanlu/cmdash/integrations/github-action@<commit-sha>`.
- uses: bgovanlu/cmdash/integrations/github-action@main
id: gate
with:
api-key: ${{ secrets.CMDASH_API_KEY }}
fail-on: '5'
- if: always()
run: |
echo "passed=${{ steps.gate.outputs.passed }}"
echo "score=${{ steps.gate.outputs.score }}"
echo "report=${{ steps.gate.outputs.report-url }}"
Until the Marketplace listing is live, uses: bgovanlu/cmdash/integrations/github-action@main above works as written — GitHub Actions can reference an action living in a subdirectory of any public repo at a tag, branch, or SHA with no publishing step required.
Inputs and outputs
Every optional input overrides your organization’s saved policy (Settings → Posture Gate) for that one run only — it never changes the saved policy. Full reference: the action’s own README.
Inputs
api-key (required), api-url, gate, fail-on, block-on-control-regression, control-regression-window-days, block-on-expired-exception.
Outputs
passed — "true"/"false". score — the score behind a cited score-drop failure, when there was one. report-url — a deep link back to your Posture Gate settings page.
Questions people actually ask
Does this work with GitLab or Bitbucket instead?
Yes — the same check ships as a CLI (@cmdash/gate-cli), a GitHub Action, a GitLab CI/CD Component, and a Bitbucket Pipe, all running the identical check against the identical endpoint with the identical exit-code contract. See the docs for the non-GitHub integrations.
Can it fail the check without blocking my whole pipeline?
Yes. The action still exits non-zero on a real regression, but a later step can read the passed output (if: always()) and decide what to do with it — post a PR comment, open a ticket, or just record it — independent of whether the job itself is marked required.
What data does cmdash see from my repository?
None. The action only calls cmdash’s own API with your organization’s API key — it never reads your repository’s code, commits, or pull request contents.