The hook point for the git layer and CI: sends the action to the guardrail engine and exits 0 when allowed, or 6 with the code, the rule ID and the exact next command. An action that needs approval opens one with your summary and prints its ID; run it again with –approval <id> once an independent agent or a person has approved it.
Usage
overlane guard check --tool TOOL [--path PATH...] [--branch BRANCH] [--repo OWNER/NAME] [--environment NAME] [--host HOST] [--task held|none] [--summary TEXT] [--content-file PATH] [--approval ID] [--dry-run]Flags
| Flag | Type | Required | Default | Description |
|---|---|---|---|---|
--tool |
string | yes | The action, for example git.push, deploy.run, egress.fetch or api.write | |
--path |
string (repeatable) | no | A path the action touches; repeat for more | |
--branch |
string | no | The branch the action targets | |
--repo |
string | no | The repository the action targets | |
--environment |
string | no | The environment, for example production | |
--host |
string | no | The host, for an egress action | |
--task |
one of held, none |
no | Whether the caller holds an active task (the task rule needs it) | |
--summary |
string | no | A plain-language summary shown to the approver if the action needs approval | |
--content-file |
string | no | A file whose text the action would write; scanned for credentials | |
--approval |
string | no | An approval that covers exactly this action | |
--dry-run |
boolean | no | Print the requests and file changes this command would make, then stop. Needs no credentials. |
Examples
overlane guard check --tool git.push --branch main --task held
overlane guard check --tool deploy.run --environment production --summary "Deploy build 42" --dry-runBehavior
- Effect:
write(changes local or hosted state). - Needs credentials: yes. Uses the network: yes.
- Supports
--dry-run: yes. Accepts--force: no. - Machine-readable description:
overlane schema guard check.
Result
With --json (the default when stdout is not a terminal) the command prints this JSON Schema’s shape on stdout.
{
"anyOf": [
{
"type": "object",
"properties": {
"decision": {
"type": "object",
"properties": {
"tenantId": {
"type": "string",
"minLength": 1,
"maxLength": 128,
"pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
"description": "tenant identifier"
},
"effect": {
"type": "string",
"enum": [
"allow",
"deny",
"require_approval"
]
},
"allowed": {
"type": "boolean"
},
"code": {
"anyOf": [
{
"type": "string",
"enum": [
"policy_denied",
"approval_required",
"protected_branch",
"path_protected",
"spend_cap_reached",
"plan_limit_reached",
"egress_blocked",
"deploy_blocked",
"secret_detected",
"task_required"
]
},
{
"type": "null"
}
]
},
"ruleId": {
"type": [
"string",
"null"
]
},
"layer": {
"anyOf": [
{
"type": "string",
"enum": [
"platform",
"team",
"project"
]
},
{
"type": "null"
}
]
},
"message": {
"type": "string",
"minLength": 1
},
"nextCommand": {
"type": [
"string",
"null"
]
},
"exitCode": {
"anyOf": [
{
"type": "number",
"const": 0
},
{
"type": "number",
"const": 6
}
]
},
"dryRun": {
"type": "boolean"
},
"wouldBlock": {
"type": "boolean"
},
"approvalId": {
"type": "string"
},
"matched": {
"type": "array",
"items": {
"type": "object",
"properties": {
"ruleId": {
"type": "string",
"minLength": 1
},
"layer": {
"type": "string",
"enum": [
"platform",
"team",
"project"
]
},
"effect": {
"type": "string",
"enum": [
"allow",
"deny",
"require_approval"
]
},
"dryRun": {
"type": "boolean"
}
},
"required": [
"ruleId",
"layer",
"effect",
"dryRun"
],
"additionalProperties": false
}
}
},
"required": [
"tenantId",
"effect",
"allowed",
"code",
"ruleId",
"layer",
"message",
"nextCommand",
"exitCode",
"dryRun",
"wouldBlock",
"matched"
],
"additionalProperties": false
},
"secrets": {
"anyOf": [
{
"type": "object",
"properties": {
"tenantId": {
"type": "string",
"minLength": 1,
"maxLength": 128,
"pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
"description": "tenant identifier"
},
"blocked": {
"type": "boolean"
},
"findings": {
"type": "array",
"items": {
"type": "object",
"properties": {
"tenantId": {
"type": "string",
"minLength": 1,
"maxLength": 128,
"pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
"description": "tenant identifier"
},
"source": {
"type": "string",
"enum": [
"push",
"task",
"evidence",
"log",
"memory",
"api"
]
},
"rule": {
"type": "string",
"minLength": 1
},
"disposition": {
"type": "string",
"enum": [
"blocked",
"reported"
]
},
"path": {
"type": "string"
},
"line": {
"type": "integer",
"exclusiveMinimum": 0,
"maximum": 9007199254740991
}
},
"required": [
"tenantId",
"source",
"rule",
"disposition"
],
"additionalProperties": false
}
}
},
"required": [
"tenantId",
"blocked",
"findings"
],
"additionalProperties": false
},
{
"type": "null"
}
]
}
},
"required": [
"decision",
"secrets"
],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"dryRun": {
"type": "boolean",
"const": true
},
"service": {
"type": "string"
},
"requests": {
"type": "array",
"items": {
"type": "object",
"properties": {
"method": {
"type": "string"
},
"path": {
"type": "string"
},
"body": {},
"note": {
"type": "string"
}
},
"required": [
"method",
"path"
],
"additionalProperties": false
}
},
"commands": {
"type": "array",
"items": {
"type": "string"
}
},
"writes": {
"type": "array",
"items": {
"type": "object",
"properties": {
"path": {
"type": "string"
},
"action": {
"type": "string",
"enum": [
"write",
"append",
"delete"
]
},
"description": {
"type": "string"
}
},
"required": [
"path",
"action",
"description"
],
"additionalProperties": false
}
},
"notes": {
"type": "array",
"items": {
"type": "string"
}
}
},
"required": [
"dryRun",
"requests",
"commands",
"writes",
"notes"
],
"additionalProperties": false
}
]
}See exit codes for the status the process returns.