GitHub Zof Documentation

Overview

Plan repository-linked validation and pull-request evidence for a GitHub workflow.

Choose the repositories and branches involved. Separate reading source from writing checks, comments, or commits; each action has a different authority and review requirement.

Who should read this

Engineers and administrators assessing a GitHub workflow.

Prerequisites

An owner authorized to approve the target systems and data flows.
Confirmation of the supported Zof integration method and service scope before creating a production dependency.

Step-by-step procedure

Define the integration boundary

Choose the repositories and branches involved. Separate reading source from writing checks, comments, or commits; each action has a different authority and review requirement.

Review authority and data access

Have the repository owner review the proposed GitHub App permissions or token permissions and repository selection. Prefer access to selected repositories. Do not grant workflow or organization administration access merely to read a repository.

Validate a representative workflow

Use a disposable branch and pull request. Verify that the result refers to the intended repository and commit, and that rerunning the same test does not attach evidence to a newer revision by mistake.

Investigate failures by category

When a result is missing, compare repository selection, branch or event filters, installation access, and the commit identifier. A successful authentication check does not establish permission to write a check or comment.

Plan revocation and retirement

Remove installation or token access when the workflow is retired. Revisit required-check settings before removing the producer of a check so pull requests are not blocked indefinitely.