Build & integrate

GitHub Action

Add AI governance to any repository's pull-request CI with a single uses: step. The Action wraps the OSS iris-security-cli — it runs offline, needs no IRIS Cloud account, and never phones home unless you opt in.

OSS vs paid. compliance scan and policy validate are fully OSS and run locally. Pushing scan results to IRIS Cloud for storage, trends, and evidence is optional — gated behind api-key + cloud entitlement, off by default.

Quick start

Create .github/workflows/iris-governance.yml:

name: IRIS Governance

on:

  pull_request:

    branches: [main]

jobs:

  iris-governance:

    runs-on: ubuntu-latest

    steps:

      - uses: actions/checkout@v4

      - uses: IRIS-Security/iris-cli@v1

        with:

          command: compliance scan

          fail-on: blocker

The Action lives in the iris-cli repository (action.yml at repo root). Pin to a release tag (@v1) for stability.

Inputs

Input	Default	Description
`command`	`compliance scan`	`compliance scan` (offline workload + obligation eval) or `policy validate` (`iris org-policy validate --strict`)
`fail-on`	`blocker`	Exit threshold for compliance scan: `blocker`, `required`, or `none`
`api-key`	empty	Optional IRIS Cloud API key — adds `--push` to compliance scan (paid cloud step)
`working-directory`	`.`	Directory to scan or validate

fail-on thresholds

Compliance obligations are ranked blocker → required → recommended. The Action maps fail-on to a non-zero exit code when obligations at or above the threshold are found:

Value	Fails when
`blocker`	Any `blocker` obligation is triggered
`required`	Any `blocker` or `required` obligation is triggered
`none`	Never fails the build (report-only)

This is dogfooding, not theater — if a repo legitimately triggers blockers, the check fails. That is the product working.

Optional cloud push

- uses: IRIS-Security/iris-cli@v1

  with:

    command: compliance scan

    fail-on: blocker

    api-key: ${{ secrets.IRIS_API_KEY }}

Requires an IRIS Cloud account with compliance-intelligence entitlement. Without api-key, the Action never contacts IRIS Cloud.

IRIS governs IRIS

IRIS runs this Action on every pull request in its own public repositories:

See a live run: iris-cli → IRIS Governance workflow.