Release gate in CI/CD

Stop an AI system from shipping until it meets your compliance bar. One request in your pipeline; with strict=true a blocked gate returns HTTP 422 and the job fails.

What the gate checks

Check	Blocks when
Classification	The system has no EU AI Act risk tier yet, or it's a prohibited practice (Art. 5).
Findings	Any open or in-progress finding is high or critical.
Controls (high-risk)	No control assessment, or fewer than `minReadiness`% (default 70) of applicable controls are implemented (Arts. 8–17).
Technical documentation (high-risk)	No Annex IV draft (Art. 11).
Red-team (high-risk, GPAI)	The latest red-team run has failed scenarios (Art. 15 / Art. 55). For other tiers this is a warning.

GitHub Actions

Store an auditor key as the V77_API_KEY secret and the system id as a variable.

jobs:
  ai-act-gate:
    runs-on: ubuntu-latest
    steps:
      - name: EU AI Act release gate
        env:
          V77_API_KEY: ${{ secrets.V77_API_KEY }}
          SYSTEM_ID: ${{ vars.V77_SYSTEM_ID }}
        run: |
          status=$(curl -sS -o gate.json -w "%{http_code}" \
            -H "Authorization: Bearer $V77_API_KEY" \
            "https://v77trust.com/api/v1/compliance-gate?systemId=$SYSTEM_ID&strict=true&minReadiness=80")
          jq -r '"Gate: \(.status) (readiness \(.readinessPercent)%)", (.blockers[]? | "✗ " + .), (.warnings[]? | "! " + .)' gate.json
          [ "$status" = "200" ] || exit 1

  deploy:
    needs: ai-act-gate
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh

Response

{
  "object": "compliance_gate",
  "passed": false,
  "status": "blocked",
  "systemId": "…",
  "systemName": "Retail credit scoring",
  "riskTier": "high_risk",
  "readinessPercent": 54,
  "blockers": [
    "2 open high/critical finding(s) must be remediated before release.",
    "High-risk control readiness is 54%, below required gate threshold of 70%."
  ],
  "warnings": [],
  "evaluatedAt": "2026-11-08T09:30:00.000Z"
}

Network or V77 errors return other status codes (401, 429, 5xx). Decide whether your pipeline should fail closed (block) or open (warn) on those; for high-risk systems, fail closed.

Run the red-team suite before the gate

For LLM-based systems, run the adversarial suite against your staging endpoint in the same pipeline, so the gate sees fresh results:

curl -sS https://v77trust.com/api/v1/systems/$SYSTEM_ID/redteam-runs \
  -H "Authorization: Bearer $V77_OWNER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "targetEndpointUrl": "https://staging.example.eu/v1/chat", "targetAuthToken": "'"$STAGING_TOKEN"'" }' \
  | jq '.summary'

This call needs an ai_owner key, and your endpoint must accept { "messages": [{ "role", "content" }] } and return { "content": "…" } or an OpenAI-style choices array.