GitHub Integration for PR Merge Evidence

The GitHub integration for PR merge evidence enables the automated attachment of pull request merge and approval details to application versions within JFrog AppTrust. This process occurs during version promotion to the configured lifecycle stages, where AppTrust resolves commits to merged GitHub pull requests and records metadata as signed evidence.

This integration is designed to support compliance audits and ensure full release traceability. It allows auditors and release managers to verify that all code reaching production-level stages has been appropriately peer-reviewed and merged through controlled workflows without manual intervention.

Evidence Collection Process

After you enable the GitHub integration for one or more lifecycle stages, AppTrust uses those stages as the points where it gathers pull request merge evidence for an application version.

When you promote or release a version to an enabled stage and the promotion succeeds, AppTrust collects evidence for that version automatically. Collection is part of the successful promotion flow and does not block or delay the promotion itself.

During collection, AppTrust identifies the code changes in the version since the previous released version (when one exists), maps those commits to merged GitHub pull requests, and attaches a signed evidence record to the application version. That record includes merge details and approvers, so you can show, for audit and governance, that the changes in the version went through peer-reviewed pull requests. All of the application versions must use semantic versioning.

After a successful promotion, you can review the application version evidence and activity log to confirm that the pull request merge evidence is attached. If commits cannot be linked to pull request merge attestations, they appear as unresolved in the evidence summary.

Setup and Configuration

The setup requires two major steps, adding the JFrog Traceability GitHub Action and configuring the AppTrust GitHub Integration for PR Merge Evidence. These are described briefly below.

Step 1: Add JFrog Traceability GitHub Action

The JFrog Traceability GitHub Action records signed pull request merge evidence in the JFrog Platform when a pull request is merged. AppTrust uses that evidence to enforce policies when you promote an application version. In this procedure, you configure the GitHub action in your GitHub workflow. The setup takes place in GitHub.

For detailed procedure, see Add JFrog Traceability GitHub Action.

Step 2: Configure AppTrust GitHub Integration for PR Merge Evidence

Evidence collection takes place when an application version is promoted to a lifecycle stage. In this procedure, you choose the lifecycle stages where the PR merge evidence collection will take place. This configuration takes place in JFrog AppTrust.

For detailed procedure, see Configure GitHub Integration for PR Merge Evidence.

What’s Next?

Learn how to Configure GitHub Integration for PR Merge Evidence.