Skip to content

GitHub and CI

Identity that travels with the repository and the pipeline.

An agent’s ECZ-ID is a short, permanent string. Commit it, link to it from the README, and read the public record from a build step — three surfaces, one identity, and nothing new inside the agent itself.

ECZ-ID stays outside the execution path. It does not broker your agent's calls, hold its credentials, or sit between it and the systems it uses.

Three surfaces

Where the identity actually shows up.

In that order. The committed declaration is the substantive one; the badge is a convenience for humans; the pipeline check is optional and reads the same public record anyone else can.

In the repository, as a committed file

The agent declares its ECZ-ID at /.well-known/ecz-agent.json on the surface it already serves. That file is source: it sits beside the code that deploys it, it is reviewed like any other change, and it travels with the repository through forks, branches and releases.

It is a static file. Nothing is added to the agent loop and no dependency is introduced.

In the README, as a live badge

The badge is an image request to the badge service, wrapped in a link to the human record. The image is drawn when someone loads the page, from the state published at that moment, so a README cannot quietly advertise a state that has since changed.

Do not commit a copy of the rendered image. A pinned SVG is a snapshot of one moment that will keep asserting itself long after it stopped being true.

In the pipeline, as a public read

The machine record is public, unauthenticated and never metered, so a build step that reads it needs no secret, no token and no service account. You can write that step in whatever your pipeline already uses.

A check reads what is published at the moment it runs. A green build is a reading with a timestamp, not a standing statement about the agent.

An agent declares its ECZ-ID at a well-known path on a surface it already serves. It is a static file. No library, no dependency, no change to the agent loop, and nothing new in the execution path.

The addresses

What a README and a build step point at.

Three public addresses, none of them requiring an account, an API key or a login. The Publish Kit issued with your Passport hands you these already composed for your own record.
Public ECZ-ID addresses used from a repository or a pipeline, and what each one is for
SurfaceAddressWhat it is for
Human recordhttps://resolver.ecocitizenz.org/p/{ecz-id}Where a README link should point. A reader lands on the live record rather than on your description of it.
Machine recordhttps://api.ecocitizenz.com/api/p/{ecz-id}.jsonThe same record as JSON on a stable schema. A pipeline step reads this one, with no key and no account.
Badge platehttps://api.ecocitizenz.com/api/badge/{ecz-id}/{plate}.svgDrawn by the badge service when the image is requested, from the record's state at that moment.

Public Resolver reads and public machine-readable records are never metered, never authenticated and never counted against any allowance. That is what makes a badge in a public README workable at all: every visitor who loads the page causes a read of the current state, and none of those reads is counted against you.

The honest limit

A badge is a pointer to a record. It is not the record.

This is the boundary that decides whether the whole practice is worth anything. A surface that lets a badge stand in for the record teaches readers to rely on an image — and an image is the easiest thing in this system to copy, cache or fabricate.

A badge is a pointer, not proof

A badge, a QR code, a screenshot or a card is a pointer to a record, not the record. Only the live Resolver is current.

The record itself is not a verdict

The record is not proof. It publishes what is currently declared and what evidence exists, with the time it was read. Re-check the live record before you rely on it.

State moves after the image is drawn

Re-check before reliance. State can change between the moment a badge is drawn and the moment an agent acts.

A repository with no badge is not a finding

No public ECZ-ID Passport found is not a safety finding. It means this identifier resolves to no published record — nothing more. Most software has no ECZ-ID yet.

If you are reading someone else’s repository, resolve the identifier rather than reading the picture. If you are publishing one, link the badge to the record so that a reader who wants the live state is one click from it.

ECZ-ID tells you what is published and by whom. What that is worth in your context is your policy's decision, not ours.

How to read a record without over-reading it

A correction worth making

There is no GitHub Actions Passport.

It gets asked often enough to be worth stating plainly, because the answer changes which subject you would be publishing an identity for.

GITHUB_ACTION is a subtype of the Plugin Passport family

It is not a family of its own, and it is not a Passport type you would resolve as one. A published Action is a distributable extension, and the Plugin family is where extensions sit in the ECZ-ID taxonomy.

The subject is the Action, not your agent

If you publish an Action for other people to run, the thing being identified is that artefact — not the agent it might operate on, and not the organisation, which is already the Parent.

A repository is not a subject either

Your repository is where an agent's declaration lives. The subject is still the logical agent your organisation operates, whichever repository it happens to be built in.

What this property does not publish

There is no ECZ-ID GitHub Action, no marketplace listing and no published workflow file to copy. Naming one here would be an invention, and this site does not name integrations it cannot point at. The free acquisition door for the Plugin family is not open on this property either.

Full integration reference, schemas and API documentation live on the Developer Gateway. This property gets you an identity and points you at the right place to wire it in.

Developer Gateway(opens in a new tab — developers.ecocitizenz.com)

Start with the identity

The badge and the pipeline step both need one thing first.

An ECZ-ID for the agent, and an organisation on the record as its operator. Everything on this page is what you do with it afterwards.