# SQLGuard Authorize Gate (GitHub Action)

> **HOLD (2026-08-07):** Anonymous `github.com/cabbageandtea/sqlguard` and `raw.githubusercontent.com` URLs **404** while the GitHub account is flagged. Paste YAML + this README are mirrored on Fly: `/examples/challenge-ci-paste.yml` · `/examples/sqlguard-authorize-gate.md`. `uses: cabbageandtea/sqlguard/.github/actions/...@master` stays blocked for third parties until Support clears the flag.

**AAM CI gate:** mutating SQL in PRs hits live Gateway `decide`. **DENY → Pilot Challenge Exact $100** (or Gateway invoice **$299/mo**). Not Session pennies. Not lint.

**What it does:** fail-closed CI on `DENY` / `REQUIRE_APPROVAL`, with `deny_id` + Challenge unlock CTA.

**What it does not do:** free `ALLOW` is **not** production authorize. Production still needs Exact PASS + `/v1/verify` (or company invoice).

## Modes

| `mode` | Behavior |
|---|---|
| `decide` (default) | `POST /v1/gateway/decide` — free magnet. DENY prints Challenge unlock. |
| `pass` | Mutating SQL requires verified Ed25519 PASS (`certificate` + `signature` → `/v1/verify` with `expected_sql_hash` = SHA-256 of gated SQL). Borrowed certs fail-closed. |

## Inputs

| Input | Required | Default | Description |
|---|---|---|---|
| `sql` | no | - | Raw SQL. Exactly one of `sql` or `sql_file_path`. |
| `sql_file_path` | no | - | Path to `.sql` file. |
| `allow_approval` | no | `false` | Fail-closed on `REQUIRE_APPROVAL` unless `true`. |
| `mode` | no | `decide` | `decide` or `pass`. |
| `certificate` | no | - | PASS cert JSON string (`mode=pass`). |
| `signature` | no | - | PASS signature (`mode=pass`). |
| `endpoint` | no | `https://sqlguard.io/v1/gateway/decide` | Decide URL. |
| `verify_endpoint` | no | `https://sqlguard.io/v1/verify` | Verify URL. |

## Outputs

- `decision` — `ALLOW` / `DENY` / `REQUIRE_APPROVAL` / `PASS`
- `deny_id` — use with `POST /v1/challenge/unlock` amount `100000000`
- `response_json`

## Paste into any repo

```yaml
- uses: cabbageandtea/sqlguard/.github/actions/sqlguard-authorize-gate@master
  with:
    sql: "DROP TABLE customers CASCADE"
```

Or copy `examples/challenge-ci-paste.yml`.

Local path (this repo):

```yaml
- uses: ./.github/actions/sqlguard-authorize-gate
  with:
    sql_file_path: ./migrations/next.sql
```

## Wealth path (when CI DENYs)

1. `deny_id` from the step output / summary  
2. Exact Pilot Challenge unlock **$100** — `POST https://sqlguard.io/v1/challenge/unlock` amount `100000000`  
3. Or Exact Pilot — `POST /v1/gateway/pilot` · UI `/buy#pilot`  
4. Or invoice Gateway Starter **$299/mo** → hello@sqlguard.io  
5. Burn PASS → `POST /v1/verify` → execute only if `ok: true`

Docs: https://sqlguard.io/GATEWAY.md · money: https://sqlguard.io/v1/money

## This repo

Wired at `.github/workflows/authorize-gate.yml` on PRs with changed `*.sql`.