# CI NHIM gate

Block merges when agent infrastructure drifts from NHIM posture. Pair with [CI/CD integration smoke](/docs/sdk/ci-cd) for MCP config verification.

## GitHub Actions

Copy [`ci/github-actions/nhim-audit`](https://github.com/Blekline/blekline-oss/tree/main/ci/github-actions/nhim-audit) or use the action inline:

```yaml
name: NHIM posture gate

on:
  pull_request:
  push:
    branches: [main]

jobs:
  nhim-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: blekline/nhim-audit-action@v1
        with:
          kubeconfig: ${{ secrets.KUBECONFIG }}
          fail-on: high
          min-score: "75"
          output: nhim-audit.json

      - uses: actions/upload-artifact@v4
        with:
          name: nhim-audit-report
          path: nhim-audit.json
```

Store `KUBECONFIG` in GitHub Secrets only — never commit cluster credentials or reports with real cluster names if policy requires redaction.

## CLI flags

| Flag | Purpose |
|------|---------|
| `--fail-on critical\|high\|any` | Severity threshold for exit 1 |
| `--min-score <n>` | Minimum posture score (0–100) |
| `--baseline <path>` | Fail only on new findings vs baseline |
| `--format sarif` | SARIF 2.1 for GitHub Advanced Security |
| `-o <path>` | Artifact output path |

```bash
npx @blekline/nhim-audit audit --format sarif -o nhim-audit.sarif
```

## Exit codes

| Code | Meaning |
|------|---------|
| `0` | Pass |
| `1` | Fail / baseline regression |
| `2` | RBAC or config error |
| `3` | Cluster unreachable |

## RBAC prerequisite

Apply the reader ClusterRole before CI runs:

```bash
kubectl apply -f https://raw.githubusercontent.com/Blekline/blekline-oss/main/packages/nhim-audit/deploy/rbac/nhim-audit-reader.yaml
```

## Blekline integration gate (optional)

For MCP and integration config verification on the same PR:

```yaml
- name: Verify integration configs
  run: node scripts/verify-integration-configs.mjs

- name: MCP smoke
  if: ${{ secrets.BLEKLINE_WORKSPACE_TOKEN != '' }}
  env:
    BLEKLINE_WORKSPACE_TOKEN: ${{ secrets.BLEKLINE_WORKSPACE_TOKEN }}
    BLEKLINE_API_URL: ${{ secrets.BLEKLINE_API_URL || 'https://app.blekline.com' }}
    BLEKLINE_CLIENT_SURFACE: sdk
  run: node scripts/mcp-smoke.mjs
```

Template: [`ci/github-actions/blekline-gate.yml.example`](https://github.com/Blekline/blekline-oss/tree/main/ci/github-actions/blekline-gate.yml.example)

## Related

- [NHIM audit quickstart](/docs/get-started/nhim-audit-quickstart)
- [NHIM Audit CLI](/docs/tools/nhim-audit) — full rule reference and probe access
- [Compliance evidence](/docs/enterprise/compliance-evidence)

**Disclaimer:** Evidence enablement only — not certification.