> ## Documentation Index
> Fetch the complete documentation index at: https://docs.selftune.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Validate reviewed releases in GitHub Actions

> Run the reusable fail-closed gate for an immutable Skill Set envelope

SelfTune includes a reusable GitHub workflow at
`.github/workflows/reviewed-skill-set-release.yml`. It validates a canonical
Skill Set envelope against the exact revision reviewed by your team. Validation
is local: it does not upload the envelope or call SelfTune Cloud.

```yaml theme={null}
jobs:
  validate-reviewed-set:
    uses: selftune-dev/selftune/.github/workflows/reviewed-skill-set-release.yml@<full-commit-sha>
    with:
      envelope_path: artifacts/support-set.json
      skill_set_id: support
      expected_revision_sha256: <64-character-reviewed-sha256>
      mode: validate
```

Pin the reusable workflow to a full commit SHA. The workflow itself pins
checkout and Bun setup to full action SHAs and Bun `1.3.11`, installs the
lockfile without lifecycle scripts, and emits deterministic envelope and
revision hash outputs. It does not accept or print a SelfTune service credential
in validation mode.

## Promote after protected approval

Promotion uses the scoped service API only after local validation succeeds. The
API atomically checks all of the following before it records the immutable
lifecycle event:

* the immutable `release_id`;
* the expected Skill Set revision SHA-256;
* the expected envelope SHA-256;
* `readiness: ready`; and
* the existing active Team owner/admin lifecycle scope.

The reusable workflow's promotion job is fixed to the
`skill-set-promotion` GitHub Environment. Configure that environment with
required reviewers and store a credential scoped only to
`skill_sets:lifecycle` as `SELFTUNE_SERVICE_TOKEN`. Never pass the credential as
a workflow input or command argument.

```yaml theme={null}
jobs:
  promote-reviewed-set:
    uses: selftune-dev/selftune/.github/workflows/reviewed-skill-set-release.yml@<full-commit-sha>
    with:
      envelope_path: artifacts/support-set.json
      skill_set_id: support
      expected_revision_sha256: <64-character-reviewed-sha256>
      mode: promote
      release_id: <immutable-hosted-release-id>
      api_base_url: https://<your-convex-http-origin>
    secrets: inherit
```

The API rejects blocked or unrecorded readiness, hash drift, deprecated
releases, revoked credentials, lapsed Team access, and credentials without the
lifecycle scope. Workflow validation is local evidence; a returned promotion
receipt is hosted development or production evidence only for the API origin
you configured.