Komatik Trailhead
release-gategithub-actionci-cd

Trailhead

2026-10-16 / projects/trailhead.mdx

Ship updates without the anxiety. A release readiness gate for GitHub PRs: waits for CI, scores risk across 17 factors, probes production health, and posts one merge check.

visit ↗

Trailhead is the release gate for the AI-agent era.

It's a GitHub Action that waits for your required CI checks, scores the pull request across 17 weighted risk factors, probes production health, folds in Code Scanning alerts, and then posts a single check: Trailhead — Release Ready. One check to require, one place to look.

Open source under MIT. No API key needed.

Quick Start

npx @komatikai/trailhead init

Presets for solo, team, agent-guard, and ops — or add uses: KomatikAI/trailhead@v4 to any workflow.

How It Decides

  • Waits for CI. Polls GitHub Checks — or GitLab, CircleCI, or a webhook — and classifies each input as blocking, advisory, or irrelevant.
  • Scores risk 0–100 from 17 factors, including security alerts, workflow security, prompt-injection risk, churn, supply chain, and CI integrity.
  • Allows, warns, or blocks. By default it allows below 55 and blocks above 70. Freeze windows and branch-aware contexts change the rules per branch.
  • Explains itself. A Release Brief in the PR comment, the job summary, and JSON: the verdict, each finding, what every input counted for, what changed since the last run, and any override.

Since May

  • v4.0 — the Release Readiness Gate (May). CI orchestration, risk, freeze windows, and health combined into one check.
  • Trailhead Cloud (May). Hosted history and a dashboard, with free, Pro, and Team tiers.
  • Beyond GitHub CI (May). GitLab, CircleCI, and webhook adapters, cross-repo impact, and trailhead doctor.
  • Built for agents (May). Machine-readable remediation and an agent brief, agent submission checks, agent trust scoring, and an autofix allowlist.
  • Audited overrides (May). A trailhead-override label that leaves an audit trail.
  • Backfill (Jul). Evaluate any PR on demand, including old ones — and a critical fix to gate on the PR's head commit rather than the merge commit.
  • Release Brief (Aug). Per-context fail-open or fail-closed, and no truncation on large PRs.
  • v4.8 (Aug). Overrides re-evaluate live when labels change, and a run that can't evaluate never reports success.

Why It Exists

AI agents open a lot of pull requests. Trailhead asks one question before each one ships, records the answer, and makes it easy to see why. It gates Komatik's own repos, including Trace.