Default path: .github/policy-gate.yml

policies:
  - id: string
    description: string
    severity: error | warn
    when: predicate
    require: predicate
    message: string

when is optional. If omitted, the policy always applies.

changed:
  - 'src/**'

exists:
  - 'README.md'

pr_text:
  - 'rollback'

title:
  - '^release:'

has_label:
  - 'deploy-change'

approval_count_at_least: 2

file_contains:
  globs:
    - 'docs/runbooks/**/*.md'
  patterns:
    - 'rollback'

Every child must pass.

At least one child must pass.

Inverts a child predicate.

• Unknown top-level and policy keys are rejected.
• Invalid severities are rejected.
• Empty IDs, messages, and arrays are rejected.
• Invalid predicate shapes are rejected.
• Negative approval thresholds are rejected.