Set up ProofLock in about ten minutes.

1. Install on selected repositories

Install ProofLock only on the repositories you want it to evaluate. You can add or remove repositories later from GitHub.

Install on GitHub ↗

2. Add a policy in audit mode

Create .github/prooflock.yml on the default branch. Audit mode reports protected changes without blocking merge while you tune the paths.

version: 1
mode: audit
approval:
  required: 1
protectedSurfaces:
  - id: tests
    title: Test suites
    paths:
      - "**/{test,tests,__tests__,spec}/**"
      - "**/*.{spec,test}.{js,jsx,ts,tsx}"
  - id: github-actions
    title: GitHub Actions
    paths:
      - ".github/workflows/**"

The versioned JSON Schema is available for editor validation.

3. Open a test pull request

Change a protected file and confirm that the ProofLock Check explains the matched surface. An eligible approval must belong to the current head commit; pushing another commit triggers a fresh evaluation.

4. Turn on enforcement

After the findings match your reviewer model, change the policy to mode: enforce. Then add ProofLock as a required status check in the repository ruleset or branch protection for the default branch.

Read GitHub's status check documentation.

Approval rules

• By default, reviewers with repository write or admin permission are eligible.
• Use approval.trustedReviewers to restrict approval to explicit GitHub logins.
• A new commit, dismissed approval, or changes-requested review invalidates prior evidence.
• The policy is always read from the pull request's base commit.