Use Witnora in CI as a set of checkpoints plus one unified evidence packet.
MCPBench Gate
name: MCPBench
on:
pull_request:
jobs:
mcpbench:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/setup-python@v5
with:
python-version: "3.11"
- run: pip install -e ".[dev]"
- run: mcpbench eval --suite basic-tool-use --agent scripted --script passing --output-dir .mcpbench/run
- uses: actions/upload-artifact@v4
with:
name: mcpbench-report
path: .mcpbench/run
Artifacts include events.jsonl, results.json, report.md, and badge.svg.
Tripwire + Unified Evidence Packet
Use this when the caller repository has a tripwire.yml that launches the
browser or computer-use agent under test. The action runs Tripwire, then writes
the Witnora evidence bundle, corpus, reviewed failure dataset, monitor
snapshot, badge, manifest, and JUnit/HTML reports.
Generate starter files:
npx witnora@latest init --subject my-browser-agent --github-action
name: Witnora Tripwire
on:
pull_request:
push:
branches: [main]
jobs:
tripwire:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v6
with:
node-version: "22"
- id: agentcert
uses: Kakarottoooo/witnora/actions/tripwire@v0
with:
config: tripwire.yml
out: .tripwire/latest
fail-under: "0.8"
subject: my-browser-agent
agentcert-out: .witnora/latest
fail-on-verdict: "true"
release-gate: "true"
strict-release-gate: "false"
# baseline: .witnora/baselines/main.json
# max-score-drop: "0"
Artifacts include:
.tripwire/latest/tripwire-result.json.tripwire/latest/tripwire-report.html.tripwire/latest/junit.xml.witnora/latest/agentcert-evidence.json.witnora/latest/agentcert-report.html.witnora/latest/agentcert-report.md.witnora/latest/agentcert-run-manifest.json.witnora/latest/badge.svg.witnora/latest/corpus.jsonl.witnora/latest/reviewed-failure-dataset.jsonl.witnora/latest/monitor.json.witnora/latest/agentcert-release-gate.json.witnora/latest/agentcert-release-gate.html.witnora/latest/agentcert-release-gate-junit.xml.witnora/latest/release-gate-badge.svg
The release gate runs in advisory mode by default: failed automated evidence
blocks, while unconfigured manual controls remain visible. Set
strict-release-gate: "true" only after the repository has supplied the
required control attestations through witnora.config.json or a separate
full release-gate job.
Hosted Continuous Assurance
The recommended path is to issue an assurance case in the Hosted workspace and download its generated CI kit. The kit binds the reviewed scope to pull-request, release, and nightly runs. Store the project key in GitHub Secrets; keep project and assurance-case identifiers in repository variables.
env:
WITNORA_BASE_URL: https://witnora.com
WITNORA_PROJECT_ID: ${{ vars.WITNORA_PROJECT_ID }}
WITNORA_API_KEY: ${{ secrets.WITNORA_API_KEY }}
steps:
- uses: actions/checkout@v7
- id: agentcert
uses: Kakarottoooo/witnora/actions/tripwire@v0
with:
config: tripwire.yml
push-hosted: "true"
assurance-case: ${{ vars.WITNORA_ASSURANCE_CASE_ID }}
assurance-scope: agentcert.assurance-scope.json
assurance-trigger: auto
require-current: "auto"
continuous-health-out: .witnora/canary/generated-kit-health.json
auto keeps pull requests prospective and makes release/nightly checks
authoritative. Scope drift on an authoritative run changes the Hosted contract
to REVALIDATION_REQUIRED; those jobs fail until an independently issued
successor case restores CURRENT. The redacted health artifact makes the full
external path observable: generated kit, CI run, Hosted evidence completeness,
freshness state, and install-to-CURRENT duration.
Hosted Evidence Page + Clickable README Badge
Set publish-pages: "true" and the action pushes the Tripwire report, the
Witnora HTML report, and the badge SVG to a GitHub Pages branch after every
run, then prints a ready-to-paste clickable badge for your README in the job
summary:
jobs:
tripwire:
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v6
with:
node-version: "22"
- id: agentcert
uses: Kakarottoooo/witnora/actions/tripwire@v0
with:
config: tripwire.yml
subject: my-browser-agent
publish-pages: "true"
# pages-branch: gh-pages (default)
# pages-dir: agentcert (default)
One-time setup: enable GitHub Pages for the gh-pages branch in the caller
repository settings (Settings -> Pages -> Deploy from a branch -> gh-pages).
The action then exposes:
-
output
agentcert-version: exact bundled CLI version used for the run -
output
pages-url:https://<owner>.github.io/<repo>/agentcert -
output
badge-markdown:
[](https://<owner>.github.io/<repo>/agentcert/latest/agentcert-report.html)
The badge links to the hosted agentcert-report.html, and the full Tripwire
report (with screenshots, DOM snapshots, and traces) is published next to it at
<pages-url>/tripwire/tripwire-report.html. Evidence is published on both
passing and failing runs. That is the point of an evidence layer.