AI agent handbacks in GitHub Actions without mistaking CI for proof.

Start with four records, not one “audit trail.”

A GitHub Actions run can produce a job log, a job summary, an uploaded artifact, and a change in another system. Those records answer different questions. Combining them into one agent transcript makes it easy to overstate what ran, leak sensitive inputs, or confuse a green job with a verified outcome.

1. Generate the handback inside the runner.

The Traceplain Agent Review Action reads a supported record from the checked-out workspace and writes a bounded Markdown handback. The input is processed on the runner and is not sent to Traceplain. Start with read-only repository permissions and safe detail suppression.

name: Review agent record
on: workflow_dispatch

permissions:
  contents: read

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build evidence-labelled handback
        id: traceplain
        uses: harmonicfutures/traceplain-review-action@v1
        with:
          path: records/agent-run.jsonl
          output: traceplain-handback.md
          detail: safe
          fail-on-review: "true"
          step-summary: "true"

Use a commit SHA instead of a moving tag when your threat model requires immutable third-party action code. Review the action source and keep its permissions narrower than the workload it is reviewing.

2. Keep the summary small and decision-shaped.

GitHub job summaries are Markdown displayed on the workflow run page and written through the per-step GITHUB_STEP_SUMMARY file. They are a good human entry point, but they are not a protected evidence store. Put the verdict and decision boundary there—not the raw prompt, file contents, credentials, or tool results.

OBSERVED    18 terminal events were present in the supplied record
OBSERVED    command exited 0 and a tracked file changed
REPORTED    agent says the production deployment succeeded
UNKNOWN     deployed revision was not read back from production
NEEDS HUMAN compare the live revision with the reviewed commit

If sensitive content reaches a job summary, deleting only a local file does not remove the uploaded summary. GitHub documents deleting the workflow run as the way to remove its summaries. Treat prevention and minimisation as the primary control.

3. Retain the handback, not the raw payload by default.

Workflow artifacts persist files after the job finishes. GitHub supports a per-artifact retention period and validates the artifact digest when it is downloaded. That establishes which bytes were transferred—not whether the handback is complete or the underlying agent record was safe to retain.

      - name: Retain bounded handback for review
        uses: actions/upload-artifact@v4
        with:
          name: traceplain-handback
          path: traceplain-handback.md
          retention-days: 7
          if-no-files-found: error

• Do not upload the raw record unless a defined review purpose requires it.
• Set the shortest retention period that supports the decision.
• Record the run URL, commit SHA, artifact name, and digest as references.
• Keep secrets, prompts, customer data, file contents, and unrestricted tool results out of the handback.

4. Treat logs and contexts as potentially sensitive input.

GitHub warns that automatic secret redaction is not guaranteed for transformed values and that several workflow context fields can contain attacker-controlled text. OpenTelemetry likewise warns that GenAI messages, instructions, tool arguments, and tool results may contain sensitive information.

1. Minimise before capture. Prefer operation, target type, status, timing, and correlation identifiers over payloads.
2. Do not interpolate untrusted context into shell code. Pass bounded values through action inputs or environment variables and validate them.
3. Keep permissions explicit. Grant write scopes only to a separate step or job that truly needs them.
4. Test failure paths. Errors often reveal arguments or results that the success path suppresses.

5. Verify the effect outside the workflow.

The Checks API, job logs, and artifact digest can show what GitHub recorded. A deployment API, database read, repository diff, or other canonical target must establish the downstream effect. Preserve both records and do not collapse them.

RUNNER      OBSERVED action produced traceplain-handback.md
ARTIFACT    OBSERVED digest sha256:… retained for 7 days
AGENT       REPORTED customer configuration was updated
TARGET      UNKNOWN no authoritative read-back is attached
DECISION    NEEDS HUMAN read target state, then approve or investigate

Acceptance checks for the CI handback.

Official references.

• GitHub Actions: adding a job summary
• GitHub Actions: workflow artifacts
• GitHub Actions: store and share data with artifacts
• GitHub Actions: secure use reference
• OpenTelemetry: handling sensitive data