Skip to content

Gate Model Adoption on a Pull Request¶

A developer finds a model on Hugging Face. Nothing stops it reaching production except somebody remembering to check it.

Wiring the pre-deployment model scan into a pull request attaches the report to the review and makes the merge the approval. It works for any public source: Hugging Face, AWS Bedrock, or an on-premises store.

Prerequisites¶

  • An AccuKnox token with permission to run scans. See How to Create Tokens.
  • A Git repository where model adoption is proposed by a pull request rather than by direct commit.
  • An ML static scan collector already configured. See ML Model Static Scans.

What the Gate Does¶

The registry push is downstream of the merge. A developer who skips the scan has an unmerged pull request and no model in the registry.

Step 1. Propose the Model in a Pull Request¶

Have the developer open a pull request that records three fields and no model weights:

model:
  name: acme-model
  link: https://huggingface.co/acme/acme-model
  provider: huggingface

Keep the weights out of the repository. The scan reads the model from its source, so a committed artifact adds review burden and proves nothing about what the source serves today.

Step 2. Trigger the Scan From a Pull Request Comment¶

Add a workflow that listens for the /scan comment and calls the AccuKnox scan job. Copy the trigger and the permissions block:

name: AccuKnox Model Scan

on:
  issue_comment:
    types: [created]

jobs:
  model-scan:
    if: github.event.issue.pull_request && contains(github.event.comment.body, '/scan')
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run AccuKnox model scan
        uses: ""  # fill in the published AccuKnox model-scan action reference
        with:
          token: ${{ secrets.ACCUKNOX_TOKEN }}
          endpoint: ${{ secrets.ACCUKNOX_ENDPOINT }}
          label: ${{ secrets.ACCUKNOX_LABEL }}

One value is deliberately blank

The uses: line ships empty. Confirm the published action name and version with AccuKnox support, fill it in, and only then commit this workflow. Every other line follows the same secret names as the AccuKnox container scan action.

Store ACCUKNOX_TOKEN, ACCUKNOX_ENDPOINT and ACCUKNOX_LABEL as repository secrets. See How to Create Tokens for the token.

Step 3. Review the Scan Report¶

The report covers four areas. A finding is a reason to ask a question, not an automatic block. A permissive license or a missing model card is a business decision, not a defect.

Area What a finding means
Supply chain and provenance The author, country of origin, training-dataset disclosure or license is missing or unexpected
Adversarial robustness The publisher disclosed no robustness or bias evaluation for the model
Data and privacy risks The model card discloses PII, or the model shows elevated membership inference risk
Model file security The artifact uses an unsafe format, carries an unsafe pickle, or embeds scripts in its config files

Treat a model file security finding as blocking. An unsafe pickle executes on load, so the code runs before any of your controls see the model. See Pickle Code Injection for a working demonstration.

Step 4. Re-Scan on Every Version Bump¶

A verdict applies only to the artifact that existed when the scan ran. An upstream publisher can push a new revision under the same model name.

  • Pin the revision in the pull request.
  • Open a new pull request when the revision changes.

A model approved once and pulled by a moving tag is not a gated model.

Known Limits¶

  • It does not scan at inference time. A model that clears the gate and is later swapped on disk is caught by ModelArmor at runtime, not here.
  • It does not test model behavior. Jailbreak and prompt-injection resistance come from AI Red Teaming, which runs against a deployed endpoint.
  • It does not enforce the merge rule. Configure branch protection so the registry push cannot run on an unmerged branch.