GitHub and CI
Identity that travels with the repository and the pipeline.
An agent’s ECZ-ID is a short, permanent string. Commit it, link to it from the README, and read the public record from a build step — three surfaces, one identity, and nothing new inside the agent itself.
ECZ-ID stays outside the execution path. It does not broker your agent's calls, hold its credentials, or sit between it and the systems it uses.
Three surfaces
Where the identity actually shows up.
In the repository, as a committed file
The agent declares its ECZ-ID at /.well-known/ecz-agent.json on the surface it already serves. That file is source: it sits beside the code that deploys it, it is reviewed like any other change, and it travels with the repository through forks, branches and releases.
It is a static file. Nothing is added to the agent loop and no dependency is introduced.
In the README, as a live badge
The badge is an image request to the badge service, wrapped in a link to the human record. The image is drawn when someone loads the page, from the state published at that moment, so a README cannot quietly advertise a state that has since changed.
Do not commit a copy of the rendered image. A pinned SVG is a snapshot of one moment that will keep asserting itself long after it stopped being true.
In the pipeline, as a public read
The machine record is public, unauthenticated and never metered, so a build step that reads it needs no secret, no token and no service account. You can write that step in whatever your pipeline already uses.
A check reads what is published at the moment it runs. A green build is a reading with a timestamp, not a standing statement about the agent.
An agent declares its ECZ-ID at a well-known path on a surface it already serves. It is a static file. No library, no dependency, no change to the agent loop, and nothing new in the execution path.
The addresses
What a README and a build step point at.
| Surface | Address | What it is for |
|---|---|---|
| Human record | https://resolver.ecocitizenz.org/p/{ecz-id} | Where a README link should point. A reader lands on the live record rather than on your description of it. |
| Machine record | https://api.ecocitizenz.com/api/p/{ecz-id}.json | The same record as JSON on a stable schema. A pipeline step reads this one, with no key and no account. |
| Badge plate | https://api.ecocitizenz.com/api/badge/{ecz-id}/{plate}.svg | Drawn by the badge service when the image is requested, from the record's state at that moment. |
Public Resolver reads and public machine-readable records are never metered, never authenticated and never counted against any allowance. That is what makes a badge in a public README workable at all: every visitor who loads the page causes a read of the current state, and none of those reads is counted against you.
The honest limit
A badge is a pointer to a record. It is not the record.
A badge is a pointer, not proof
A badge, a QR code, a screenshot or a card is a pointer to a record, not the record. Only the live Resolver is current.
The record itself is not a verdict
The record is not proof. It publishes what is currently declared and what evidence exists, with the time it was read. Re-check the live record before you rely on it.
State moves after the image is drawn
Re-check before reliance. State can change between the moment a badge is drawn and the moment an agent acts.
A repository with no badge is not a finding
No public ECZ-ID Passport found is not a safety finding. It means this identifier resolves to no published record — nothing more. Most software has no ECZ-ID yet.
If you are reading someone else’s repository, resolve the identifier rather than reading the picture. If you are publishing one, link the badge to the record so that a reader who wants the live state is one click from it.
ECZ-ID tells you what is published and by whom. What that is worth in your context is your policy's decision, not ours.
A correction worth making
There is no GitHub Actions Passport.
GITHUB_ACTION is a subtype of the Plugin Passport family
It is not a family of its own, and it is not a Passport type you would resolve as one. A published Action is a distributable extension, and the Plugin family is where extensions sit in the ECZ-ID taxonomy.
The subject is the Action, not your agent
If you publish an Action for other people to run, the thing being identified is that artefact — not the agent it might operate on, and not the organisation, which is already the Parent.
A repository is not a subject either
Your repository is where an agent's declaration lives. The subject is still the logical agent your organisation operates, whichever repository it happens to be built in.
What this property does not publish
There is no ECZ-ID GitHub Action, no marketplace listing and no published workflow file to copy. Naming one here would be an invention, and this site does not name integrations it cannot point at. The free acquisition door for the Plugin family is not open on this property either.
Full integration reference, schemas and API documentation live on the Developer Gateway. This property gets you an identity and points you at the right place to wire it in.
Developer Gateway(opens in a new tab — developers.ecocitizenz.com)
Start with the identity