Gate pull requests on agent readiness

The workflow

Drop this in .github/workflows/agent-readiness.yml, set secrets.X402_PRIVATE_KEY (a dedicated wallet with a few dollars of USDC on Base) and vars.PREVIEW_URL. Not on GitHub? examples/agent-readiness-ci.sh in the repo is the same gate in plain bash — and any x402 v2 client works for the payment step.

Copy workflow

name: Agent Readiness

on:
  pull_request:

# COST: ~$0.075 USDC per run (one quick-depth Agent Readiness audit; payment
# settles only on a successful response, so a failed audit costs nothing).
#
# secrets.X402_PRIVATE_KEY — EVM private key for a DEDICATED wallet holding a
#     few dollars of USDC on Base mainnet (eip155:8453). Buy/send USDC on Base
#     via Coinbase, or bridge. Never reuse a treasury or personal key.
# vars.PREVIEW_URL — publicly reachable URL of the deployed PR preview. The
#     audit runs on Santos infrastructure: localhost, private IPs, and
#     auth-protected previews CANNOT be audited. For Vercel, map the
#     deployment URL into this variable, or point at a staging URL.
# vars.AGENT_READY_MIN (optional) — minimum passing score, default 70.

jobs:
  agent-readiness:
    runs-on: ubuntu-latest
    env:
      PREVIEW_URL: ${{ vars.PREVIEW_URL }}
      AGENT_READY_MIN: ${{ vars.AGENT_READY_MIN || '70' }}
      X402_PRIVATE_KEY: ${{ secrets.X402_PRIVATE_KEY }}
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install the x402 client
        run: npm install --no-save @x402/fetch @x402/evm viem

      - name: Pay for the audit and enforce the score threshold
        run: |
          cat > agent-readiness-check.mjs <<'EOF'
          import { privateKeyToAccount } from "viem/accounts";
          import { wrapFetchWithPaymentFromConfig } from "@x402/fetch";
          import { ExactEvmScheme } from "@x402/evm";

          const account = privateKeyToAccount(process.env.X402_PRIVATE_KEY);
          const fetchWithPay = wrapFetchWithPaymentFromConfig(fetch, {
            schemes: [{ network: "eip155:8453", client: new ExactEvmScheme(account) }],
          });

          const min = Number(process.env.AGENT_READY_MIN || "70");
          const endpoint =
            "https://api.santosautomation.com/api/agent-readiness?url=" +
            encodeURIComponent(process.env.PREVIEW_URL) + "&depth=quick";

          // Unpaid, the endpoint returns 402 PAYMENT-REQUIRED; fetchWithPay
          // signs the quoted ~$0.075 USDC terms and retries automatically.
          const res = await fetchWithPay(endpoint);
          if (!res.ok) {
            console.error(`Audit failed: HTTP ${res.status}`, await res.text());
            process.exit(1);
          }
          const report = await res.json();
          console.log(`Agent Readiness: score ${report.score}/100, grade ${report.grade}`);
          if (typeof report.score !== "number" || report.score < min) {
            console.error(`Score ${report.score} is below the required minimum of ${min}.`);
            process.exit(1);
          }
          console.log(`Score ${report.score} >= ${min} — gate passed.`);
          EOF
          node agent-readiness-check.mjs