The repository action renders an InferCrane semantic plan into the job summary and writes the exact
JSON plan as an artifact. Plan mode is read-only.
Pin the action to a published release tag or full commit SHA. Do not use a floating branch for a
production delivery workflow.
Protected apply
Apply requires both mode: apply and confirm-apply: "true". Configure a GitHub environment with
required reviewers; the action cannot and does not infer organizational approval policy.
Closing or cancelling the job stops only its waiter. The action reports the durable operation ID so
an operator can resume with infercrane operation watch.
Exact release check
The check passes only when the expected revision is active, serving, converged, has no active
operation, and has a persisted complete, cryptographically verified Inference Passport. The job summary and
machine-readable artifact include its digest and public key identity. Output is stripped of
terminal escapes, bounded for GitHub summaries, and redacts values from credential-like environment
variables. The action does not print or upload prompt content.