CI cookbook

Copy-paste GitHub Action that installs kprompt, emits a plan-only PlanResult JSON, and fails on jq gates — example only (IC-007).

Example only — not production policy. The workflow is PLAN-ONLY (no --approve). You supply a staging/sandbox kubeconfig via secret KPROMPT_KUBECONFIG_B64. A passing gate means your jq predicates passed, not that the plan is safe for production.

Canonical files in the product repo: docs/ci-cookbook.md and examples/github-actions/planresult-gate.yml. Copy the YAML into .github/workflows/, edit prompt/namespace, open a PR.

Default jq gates

  • risk.denied == false
  • plan.intent matches your expected intent (example: scale)
  • no delete ops in plan.actions
  • blastRadius namespaces length ≤ 1 (when present)
  • applied == false (plan-only)

Prefer GitOps PR mode or laptop --approve after review for mutations. Optional CI apply behind a GitHub Environment is commented in the example — keep it off unless you accept the risk.