Building a governed CI/CD pipeline with Cadreen

name: Governed Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: '1.24'

      - name: Governed deployment
        env:
          CADREEN_API_KEY: ${{ secrets.CADREEN_API_KEY }}
        run: go run ./scripts/deploy.go

package main

import (
    "context"
    "fmt"
    "os"

    cadreen "github.com/timothy-billingrails/cadreen-sdks/go/cadreen"
)

func main() {
    client := cadreen.NewClient(os.Getenv("CADREEN_API_KEY"))

    // Assess the deployment
    result, err := client.AssessWithDomain(context.Background(),
        "Deploy latest commit to production",
        "infrastructure",
    )
    if err != nil {
        fmt.Printf("Assessment failed: %v\n", err)
        os.Exit(1)
    }

    if result.GovernanceDecision == nil {
        fmt.Println("No governance decision returned")
        os.Exit(1)
    }

    switch result.GovernanceDecision.Type {
    case "auto":
        fmt.Println("Auto-approved. Deploying...")
        // deploy()
    case "handoff", "escalate":
        fmt.Printf("Requires approval: %s\n", result.GovernanceDecision.Reason)
        os.Exit(0) // Wait for human
    }
}