EU CRA

Advisory, non-binding evidence gathering and operational readiness workflows for Regulation (EU) 2024/2847.

Experimental package9 workflowsRequires gh-aw v0.88.4

Package guide

The EU CRA package helps a private Central Agentic Ops control repository identify relevant product repositories and gather evidence for Regulation (EU) 2024/2847. It never makes final legal, conformity, notification, or market-release decisions.

Package Contents

Workflow	Responsibility
`eu-cra-compliance`	Discovers, ranks, selects, and dispatches repository-level work.
`eu-cra-compliance-scope-classifier`	Builds scope, role, FOSS-treatment, and product-classification evidence for human review.
`eu-cra-compliance-security-requirements-auditor`	Audits product cybersecurity requirement evidence.
`eu-cra-compliance-supply-chain-sbom-auditor`	Audits component, SBOM, dependency, and provenance evidence.
`eu-cra-compliance-vulnerability-handling-auditor`	Audits vulnerability intake, remediation, disclosure, updates, and support evidence.
`eu-cra-compliance-article-14-reporting-readiness`	Audits Article 14 awareness, escalation, timeline, and notification-evidence readiness.
`eu-cra-compliance-conformity-release-evidence`	Audits technical documentation, conformity, declaration, and release-gate evidence.
`eu-cra-compliance-package-maintainer`	Daily audits fleet coverage against the current Act and maintains the implementation ledger.

The orchestrator dispatches at most 48 repository-level workers per run. Each worker creates at most one evidence issue, uses the shared control plane, and defaults to review output.

The package maintainer runs independently of repository dispatch. It updates the implementation-status ledger only through a draft pull request and may open at most one deduplicated issue for the highest-priority concrete fleet gap. Installed packages keep the ledger at .github/aw/eu-cra-compliance/implementation-status.md.

Install and Configure

gh aw add githubnext/gh-aw-cao/eu-cra-compliance@<catalog-release>

Configure the shared GitHub App or PAT described in the authentication guide, then declare the package and workers in .github/workflows/cao.json:

{
  "version": 1,
  "control-plane": {
    "packages": {
      "eu-cra-compliance": {
        "workers": {
          "scope-classifier": {
            "workflow": "eu-cra-compliance-scope-classifier"
          },
          "security-requirements-auditor": {
            "workflow": "eu-cra-compliance-security-requirements-auditor"
          },
          "supply-chain-sbom-auditor": {
            "workflow": "eu-cra-compliance-supply-chain-sbom-auditor"
          },
          "vulnerability-handling-auditor": {
            "workflow": "eu-cra-compliance-vulnerability-handling-auditor"
          },
          "article-14-reporting-readiness": {
            "workflow": "eu-cra-compliance-article-14-reporting-readiness"
          },
          "conformity-release-evidence": {
            "workflow": "eu-cra-compliance-conformity-release-evidence"
          }
        }
      }
    }
  }
}

The omitted fields default to an enabled package and workers, review mode, one repository, and 100 percent rollout. Each worker may set its own enabled and max-mode fields. Promote to limited live only after reviewing evidence handling and credential access.

Safety Boundaries

The orchestrator selects repositories but performs no CRA analysis.
Workers treat target content as untrusted and use read-only GitHub permissions.
Visible results use declared safe outputs; no worker contacts a regulator.
Material scope, classification, role, conformity, reporting, declaration, and release decisions require explicit human review.
Findings use bounded evidence statuses, never compliance, certification, or CE approval claims.
Regulatory dates and interpretations are verified against current authoritative sources; non-binding guidance is labeled.
All package agents use Pi with the GitHub Copilot backend through the CLI and GitHub proxies.

Direct checkouts include frozen operational-value evaluators for all six repository workers and the package maintainer. gh aw add transports the focused package’s workflow-local package-maintainer evaluator with the installed workflow.

Add this package

From a private control repository, install a reviewed release tag or full commit SHA:

gh aw add githubnext/gh-aw-cao/eu-cra-compliance@<catalog-release>

Follow the Quickstart for prerequisites and first-run validation, or view the package source on GitHub.

Package inventory

.github/workflows/shared/control.md
.github/workflows/eu-cra-compliance.md
.github/workflows/eu-cra-compliance-package-maintainer.md
.github/workflows/eu-cra-compliance-scope-classifier.md
.github/workflows/eu-cra-compliance-security-requirements-auditor.md
.github/workflows/eu-cra-compliance-supply-chain-sbom-auditor.md
.github/workflows/eu-cra-compliance-vulnerability-handling-auditor.md
.github/workflows/eu-cra-compliance-article-14-reporting-readiness.md
.github/workflows/eu-cra-compliance-conformity-release-evidence.md

View aw.yml on GitHub