GitHub Actions

1. Create a trust rule

In the console: app → OIDC → new rule.

Field	Example
Subject pattern	repo:acme/app:ref:refs/tags/v* (or repo:acme/app:environment:production)
Scopes	builds:write, builds:read

Optional but recommended: restrict to one workflow file with workflowRef. Rules that would also match pull requests are refused. See OIDC.

2. Add the workflow

.github/workflows/moatgator.yml

name: moatgator
on:
  push:
    tags: ["v*"]
  workflow_dispatch: {}
permissions:
  contents: read
  id-token: write # the job asks GitHub for the OIDC token
jobs:
  protect:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
      - uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
        with: { distribution: temurin, java-version: 17 }
      - run: ./gradlew bundleRelease
      - uses: moatgator-hq/github-action@v1 # in production, pin to a full commit SHA
        with:
          artifact: app/build/outputs/bundle/release/*.aab
          app-version: ${{ github.ref_name }}
          app-id: app_REPLACE_ME # the app that trusts this repository
          config: moatgator.yml # optional: validates before uploading
          scan-min-grade: C # optional: runs the Scan and fails below this grade

Replace app_REPLACE_ME with your app id. For React Native and Flutter, change the build step and the artifact path (see the platform guides).

Inputs, outputs and failures

• Outputs: build-id, engine, protected (today always false), protected-path (empty today), scan-grade, report-url.
• The job ends with the CLI's exit code and a message. While the engine is in preview the Action adds a warning annotation, and require-protected: true fails the job on purpose.

Scan uploads your package

scan-min-grade sends the package to Moatgator for static analysis and keeps it for 24 hours. It is off unless you set it.

Without the Action

- run: npx moatgator protect app/build/outputs/bundle/release/app-release.aab --app-version ${{ github.ref_name }}
  env:
    MOATGATOR_APP_ID: app_REPLACE_ME

The CLI asks GitHub for the OIDC token, exchanges it, and uses the short token.

Security checklist

• Trigger on tags or protected branches. Never pull_request_target.
• Keep permissions minimal, as above.
• Pin every third-party action by SHA (the SHAs above were checked against the GitHub API on 11 Oct 2026; update them with Dependabot).