The release gate for the
AI-agent era.
Trailhead waits for your CI, scores every pull request across 17 weighted risk factors, checks production health, and gates AI-authored PRs before they hit main — one Release Ready check, one merge rule.
Free as a GitHub Action · no API key required to start
- uses: KomatikAI/trailhead@v4
with:
gate-mode: release-ready
wait-for-checks: "true"
risk-threshold: "70"Three steps from PR open to merge decision
Install the Action
Add one workflow step. Trailhead reads .trailhead.yml, waits for your required CI checks, and posts a single composite check on every pull request.
Score risk, CI, and health
17 weighted factors — code churn, security alerts, supply-chain changes, sensitive files, CI integrity, deploy history — roll up into a 0-100 risk score, plus a production health probe.
Get one merge decision
allow, warn, or block. "Trailhead — Release Ready" is the one check your branch protection rule requires, so there's nothing else to reconcile across CI and risk.
Gate the PRs your agents open, not just the ones your team writes
Copilot, Codex, and Claude now open pull requests directly. Trailhead treats agent-authored code as a distinct risk class instead of scoring it the same as a human diff — the gap most CI tooling still ignores in 2026.
Provenance classification
Every PR is labeled human, dependabot, copilot, codex, claude, custom-bot, or unknown.
Agent-policy findings
Sensitive-path gates, required-approval counts, and code-owner review for agent-authored PRs.
Session-burst detection
Flags correlated bursts of agent commits inside a time window — a signature of runaway automation.
Trust profiles & SLAs
Per-repo strictness (baseline, elevated, strict) plus escalation status and acknowledge/resolve SLAs.
Governance policies (approval requirements, sensitive-path gates, strict unknown-provenance handling) are configured per-repo in .trailhead.yml — see the agent governance docs.
We run Trailhead on our own agent fleet
Komatik gates every pull request its own AI agents open against KomatikAI/agents with the same submission engine, trust scoring, and risk factors shipped here — provenance classification, sensitive-path policies, and Gate 1 submission checks, running on real, autonomous, multi-agent PR traffic every day.
Free to gate. Paid to remember.
The Action is free forever — no API key, no store. Trailhead Cloud adds hosted evaluation history, dashboards, and org-wide agent-governance policy for teams that need the record.
Risk-only gate, local
5,000 evals/mo + dashboard
50,000 evals/mo + org rollup + SSO
Ship your next PR through a real gate
Add the Action in a few minutes. Add Cloud when you need the history.