witnora

GitHub Actions

Use Witnora in CI as a set of checkpoints plus one unified evidence packet.

MCPBench Gate

name: MCPBench

on:
  pull_request:

jobs:
  mcpbench:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - run: pip install -e ".[dev]"
      - run: mcpbench eval --suite basic-tool-use --agent scripted --script passing --output-dir .mcpbench/run
      - uses: actions/upload-artifact@v4
        with:
          name: mcpbench-report
          path: .mcpbench/run

Artifacts include events.jsonl, results.json, report.md, and badge.svg.

Tripwire + Unified Evidence Packet

Use this when the caller repository has a tripwire.yml that launches the browser or computer-use agent under test. The action runs Tripwire, then writes the Witnora evidence bundle, corpus, reviewed failure dataset, monitor snapshot, badge, manifest, and JUnit/HTML reports.

Generate starter files:

npx witnora@latest init --subject my-browser-agent --github-action

name: Witnora Tripwire

on:
  pull_request:
  push:
    branches: [main]

jobs:
  tripwire:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v6
        with:
          node-version: "22"

      - id: agentcert
        uses: Kakarottoooo/witnora/actions/tripwire@v0
        with:
          config: tripwire.yml
          out: .tripwire/latest
          fail-under: "0.8"
          subject: my-browser-agent
          agentcert-out: .witnora/latest
          fail-on-verdict: "true"
          release-gate: "true"
          strict-release-gate: "false"
          # baseline: .witnora/baselines/main.json
          # max-score-drop: "0"

Artifacts include:

The release gate runs in advisory mode by default: failed automated evidence blocks, while unconfigured manual controls remain visible. Set strict-release-gate: "true" only after the repository has supplied the required control attestations through witnora.config.json or a separate full release-gate job.

Hosted Continuous Assurance

The recommended path is to issue an assurance case in the Hosted workspace and download its generated CI kit. The kit binds the reviewed scope to pull-request, release, and nightly runs. Store the project key in GitHub Secrets; keep project and assurance-case identifiers in repository variables.

env:
  WITNORA_BASE_URL: https://witnora.com
  WITNORA_PROJECT_ID: $
  WITNORA_API_KEY: $

steps:
  - uses: actions/checkout@v7
  - id: agentcert
    uses: Kakarottoooo/witnora/actions/tripwire@v0
    with:
      config: tripwire.yml
      push-hosted: "true"
      assurance-case: $
      assurance-scope: agentcert.assurance-scope.json
      assurance-trigger: auto
      require-current: "auto"
      continuous-health-out: .witnora/canary/generated-kit-health.json

auto keeps pull requests prospective and makes release/nightly checks authoritative. Scope drift on an authoritative run changes the Hosted contract to REVALIDATION_REQUIRED; those jobs fail until an independently issued successor case restores CURRENT. The redacted health artifact makes the full external path observable: generated kit, CI run, Hosted evidence completeness, freshness state, and install-to-CURRENT duration.

Hosted Evidence Page + Clickable README Badge

Set publish-pages: "true" and the action pushes the Tripwire report, the Witnora HTML report, and the badge SVG to a GitHub Pages branch after every run, then prints a ready-to-paste clickable badge for your README in the job summary:

jobs:
  tripwire:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v6
        with:
          node-version: "22"

      - id: agentcert
        uses: Kakarottoooo/witnora/actions/tripwire@v0
        with:
          config: tripwire.yml
          subject: my-browser-agent
          publish-pages: "true"
          # pages-branch: gh-pages   (default)
          # pages-dir: agentcert     (default)

One-time setup: enable GitHub Pages for the gh-pages branch in the caller repository settings (Settings -> Pages -> Deploy from a branch -> gh-pages).

The action then exposes:

[![Witnora](https://<owner>.github.io/<repo>/agentcert/latest/badge.svg)](https://<owner>.github.io/<repo>/agentcert/latest/agentcert-report.html)

The badge links to the hosted agentcert-report.html, and the full Tripwire report (with screenshots, DOM snapshots, and traces) is published next to it at <pages-url>/tripwire/tripwire-report.html. Evidence is published on both passing and failing runs. That is the point of an evidence layer.

This site is open source. Improve this page.