AATS in CI

Overview

ColomboAI-com/aats-action@v1 checks a reviewed manifest across 11 of 25 AATS v0.9 domains. Its PASS result is a static manifest-subset result and cannot issue certificates.

• Pin the Action to a full release SHA when required.
• Use least-privilege workflow token permissions.
• Treat PR comments as self-declared readiness summaries.
• Reassess runtime configuration after deployment.

Production checklist

• Keep credentials in a server-side secret store.
• Set explicit cost, latency, privacy, provider, and regional constraints.
• Capture route and evaluation evidence for incident review.
• Test timeouts, cancellation, fallback, and denied-policy paths before rollout.