Policy templates
Availability
Templates are ready-made policies for common cases. Each one is an ordinary form policy: after you create it, it shows up in the list like any other policy, and you can change or archive it in the editor.
Create a policy from a template
- On the Policies tab of the Gates page, click New from template.
- Pick a template. Each card shows the subjects it works for (releases, pull requests) and the mode we suggest. A card with a plan badge needs a plan your organization does not have.
- Check the name, the mode and the rule settings. Generated Rego shows the Rego Prodgator builds from the settings.
- Choose where the policy applies. Pull request templates start with every repository () and the repository's default branch. Release templates ask for a gate. You can skip this step and add a binding later.
- Click Create policy.
If the policy is created but the binding fails (for example, because the repository pattern is not valid), the policy stays and Prodgator opens it so you can add the binding by hand.
Templates
| Template | Subjects | Suggested mode | Rules | Suggested binding |
|---|---|---|---|---|
| Require all status checks to pass | Pull requests | Enforce | Required checks: every check green, required check , a commit with no other checks passes after 120 seconds. Blocking. | All repositories, default branch |
| Require incremental changes | Pull requests | Observe | Change size: at most 30 files and 800 lines changed, lock files, snapshots and folders excluded. Blocking. | All repositories, default branch |
| Require a Prodgator approval | Pull requests | Enforce | Prodgator approvers: 1 approval from anyone whose role can approve, not the author, asked again after a new commit. Blocking. | All repositories, default branch |
| Change advisory board approval for protected environments | Releases | Enforce | Prodgator approvers: 1 approval from the approver group you pick, no self-approval. Blocking. | A gate you pick, such as Production |
| Do not merge label | Pull requests | Enforce | Labels: forbids and . Blocking. | All repositories, default branch |
| Require an SBOM for releases | Releases | Observe | Attestations: a passing SBOM attestation from a trusted source. Blocking. | A gate you pick |
| Require the approved build workflow | Pull requests and releases | Observe | Required reusable workflow: the runs call at any ref. Replace the example path with your build workflow on the customize step. Blocking. | All repositories, default branch |
| Only release managers can release | Releases | Enforce | Allowed actors: only members of the approver group you pick may start the release. Blocking. | A gate you pick, such as Production |
| Block critical security findings | Pull requests and releases | Enforce | Security findings: 0 critical findings introduced, no limit on high, medium or low, no open-finding limit. Blocking. | All repositories, default branch |
| Require build provenance | Releases | Observe | Attestations: a passing build provenance attestation from a trusted source. Blocking. | A gate you pick |
The change advisory board and release managers templates need an approver group. Create one on the Approver groups tab first if you have none.
Why some templates start in Observe
A policy in Observe mode evaluates and records its results but never answers GitHub, so it cannot block anything. We suggest Observe for:
- Require incremental changes: size limits depend on the team and the repository. Watch the results for a week or two, adjust the limits or the excluded paths, then switch to Enforce.
- Require an SBOM for releases: releases fail until your pipeline sends SBOM attestations with the Prodgator report action. Switch to Enforce once they arrive.
- Require the approved build workflow: repositories that do not call your build workflow yet fail. Check the results, move those repositories to the shared workflow, then switch to Enforce. The template binds to pull requests; to cover releases too, also bind the policy to a gate. See Required reusable workflow.
- Require build provenance: releases fail until your pipeline sends a attestation with the Prodgator report action, for example from or your own SLSA output. Switch to Enforce once they arrive.
The other templates start in Enforce, because what they ask for is clear from the start. You can change the mode on the customize step or later in the editor.
Change size
The Change size rule behind Require incremental changes can be added to any pull request policy in the editor. See Change size for how it counts files and lines.
AI-assisted changes
A form rule that asks more of AI-assisted pull requests and releases: extra approvals, an approval from an approver group, or a label.
Draft a policy with AI
Describe a release policy in plain words; the assistant writes form rules or Rego with tests, and only a draft whose tests pass can be loaded into the editor.