Gate, Compile, and Policy
Two GitHub Actions and a policy engine give you a full governance loop in CI — score existing skills, compile SOP documents into SKILL.md, and enforce team rules before anything merges.
Before you start
- Generate a workspace CI key from Cromus Account → CI & Developer. Keys begin with cromus_ci_.
- Add the key as a GitHub repository secret named CROMUS_API_KEY (or any name — pass it via cromus-api-key).
- Gate scoring is unlimited on every plan and never counts against compile allowances. Compilation requires Builder plan or above.
Cromus Gate
Scores SKILL.md and AGENTS.md files on every PR using the same deterministic Croms engine as the in-app validator. Blocks when a file hits the Critical band or a Specialist finds an error-severity violation; annotates the offending file directly in the PR diff.
Example workflow
name: Cromus Gate
on:
pull_request:
paths:
- '**.skill.md'
- '**/SKILL.md'
- '**/AGENTS.md'
jobs:
gate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Score skills
uses: cromus/cromus-gate-action@v1
with:
cromus-api-key: ${{ secrets.CROMUS_API_KEY }}Inputs
Outputs
Cromus Compile
Watches a folder of SOP documents (.md, .txt, .docx, .pdf), compiles any that changed in the triggering push into SKILL.md files, and opens (or updates) a pull request. Nothing machine-generated reaches the default branch without human review.
Minimal example
name: Compile SOPs to skills
on:
push:
paths:
- 'sops/**'
pull_request:
paths:
- 'sops/**'
permissions:
contents: write
pull-requests: write
jobs:
compile:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Compile SOPs
uses: cromus/compile-action@v1
with:
cromus-api-key: ${{ secrets.CROMUS_API_KEY }}With Specialist review (also-gate: true)
Add also-gate: 'true' and the action scores each generated skill immediately after writing it, appending Specialist findings to the pull request body and writing them as step annotations.
name: Compile SOPs with Specialist review
on:
push:
paths:
- 'sops/**'
permissions:
contents: write
pull-requests: write
jobs:
compile:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Compile SOPs to SKILL.md (with Specialist review)
uses: cromus/compile-action@v1
with:
cromus-api-key: ${{ secrets.CROMUS_API_KEY }}
watch-folder: sops/
output-folder: skills/
also-gate: 'true'Folder layout
Given watch-folder: sops/ and output-folder: skills/, each source document maps to a SKILL.md in a subdirectory named after the document stem:
sops/customer-onboarding.md → skills/customer-onboarding/SKILL.md sops/billing/refund-process.md → skills/billing/refund-process/SKILL.md sops/handoff.docx → skills/handoff/SKILL.md
Inputs
Outputs
Policy-as-code
Add a cromus.policy.yml to your repository root and the Compile action enforces it automatically after each pull request is created. Violations annotate the skill file and fail the step. The same rules run in the VS Code extension on every save.
Supported rules
Example policy file
# cromus.policy.yml — place in your repository root
version: 1
rules:
min_croms: 200 # reject skills scoring below 200
max_cost_per_run: 0.05 # reject skills costing more than $0.05/run
require_ethos: true # every skill must have an ethos: block
allowed_providers:
- openai
- anthropic
- googleRequired permissions
The Compile action needs two permissions and nothing else. The Gate action does not require any extra permissions beyond the default read-only access.
permissions: contents: write # push the compiled branch pull-requests: write # open or update the pull request
Ready to govern your skills in CI?
Generate a CI key, add it as a repository secret, and add the workflow YAML above. Gate scoring is free on every plan — no credit card required to get started.