As Decided Sentry

Deterministic code enforcement for engineering decisions.

Enforcement guide · Product site · Release record

Sentry checks machine-readable constraints carried by your decision artifacts against the source changes in a pull request. It supports required and forbidden patterns, import boundaries, full-tree certification, and SARIF annotations—without embeddings, network calls, or an LLM judge.

Use it

name: Sentryon:
pull_request:
permissions:
contents: readsecurity-events: writejobs:
sentry:
runs-on: ubuntu-lateststeps:
- uses: actions/checkout@v4with:
fetch-depth: 0
- uses: asdecided/sentry@v0.26.0

By default, Sentry checks added lines against the pull request base and uploads one SARIF report to GitHub Code Scanning.

Use full: "true" to certify the complete repository tree:

 - uses: asdecided/sentry@v0.26.0with:
full: "true"

Decision constraints

Add a Code Constraints block to an accepted decision:

version: 1eligibility: eligiblereason: "The dependency boundary is deterministic and repository-local."rules:
- id: domain-has-no-database-driverkind: forbid_importpath_glob: "src/domain/**/*.rs"pattern: "^(sqlx|diesel)(::|$)"message: "Domain code must not import a database driver."

Supported rule kinds:

• forbid_import
• forbid_pattern
• require_pattern

Sentry deliberately has no model-judged escape hatch. A decision is either enforced through a deterministic rule, explicitly ineligible, or visibly unclassified.

Inputs

Input	Default	Purpose
path	decisions	Decision corpus directory
repository	.	Source repository root
base	PR base SHA	Git base revision for diff mode
full	false	Check the complete tree
upload-sarif	true	Upload Code Scanning results
sarif-file	asdecided-sentry.sarif	SARIF output path
asdecided-version	0.26.0	Native release to install

Authoritative development lives in asdecided/ci.