GitHub App for pull request integrity

ProofLock

Integrity before merge.

A pull request should not be able to weaken the tests, workflows, or policy used to judge itself. ProofLock evaluates those changes against rules from the base commit.

Install on GitHub Read the setup guide

Free to use · Choose specific repositories · No user OAuth

All systems operational Backlog 0 · Recovery 0 View status

How it works

The rules stay outside the change.

ProofLock binds policy, approval, and the final Check to evidence the pull request cannot rewrite retroactively.

Read the base policy

The active pull request cannot weaken the policy currently evaluating it.

Verify current-head approval

A new commit invalidates stale approval and starts a fresh integrity decision.

Publish one stable Check

Protected changes stay visible until the required evidence is current and eligible.

Start safely

Audit first. Enforce when ready.

Install on selected repositories, inspect real pull requests in audit mode, then make the ProofLock Check required and switch to enforce.

Follow the setup

.github/prooflock.ymlversion: 1
mode: audit
approval:
  required: 1
protectedSurfaces:
  - id: verification
    paths:
      - ".github/workflows/**"
      - "**/tests/**"
      - "**/lockfiles/**"

Least privilege

Only the access needed to decide.

ProofLock does not request user identity or write repository contents. Installation tokens are narrowed to one repository.

Read security details Read privacy policy

ChecksRead and write

ContentsRead only

Pull requestsRead only

User OAuthNot requested

Make verification changes impossible to ignore.

Install on selected repositories and begin in audit mode.

Install ProofLock Getting started