Warning
EU CRA is advisory and non-binding. It provides no legal advice or certification and no guarantee of completeness, correctness, accuracy, or alignment with the EU Cyber Resilience Act. Human review against current authoritative sources is required.
The EU CRA campaign helps a private Central Agentic Ops control repository identify relevant product repositories and gather evidence for Regulation (EU) 2024/2847. It never makes final legal, conformity, notification, or market-release decisions.
| Workflow | Responsibility |
|---|---|
eu-cra-compliance |
Discovers, ranks, selects, and dispatches repository-level work. |
eu-cra-compliance-scope-classifier |
Builds scope, role, FOSS-treatment, and product-classification evidence for human review. |
eu-cra-compliance-security-requirements-auditor |
Audits product cybersecurity requirement evidence. |
eu-cra-compliance-supply-chain-sbom-auditor |
Audits component, SBOM, dependency, and provenance evidence. |
eu-cra-compliance-vulnerability-handling-auditor |
Audits vulnerability intake, remediation, disclosure, updates, and support evidence. |
eu-cra-compliance-article-14-reporting-readiness |
Audits Article 14 awareness, escalation, timeline, and notification-evidence readiness. |
eu-cra-compliance-conformity-release-evidence |
Audits technical documentation, conformity, declaration, and release-gate evidence. |
eu-cra-compliance-campaign-maintainer |
Daily audits fleet coverage against the current Act and maintains the implementation ledger. |
The orchestrator dispatches at most 48 repository-level workers per run. Each worker creates at most one evidence issue, uses the shared control plane, and defaults to review output.
The campaign maintainer runs independently of repository dispatch. It updates the implementation-status ledger only through a draft pull request and may open at most one deduplicated issue for the highest-priority concrete fleet gap. Installed campaigns keep the ledger at eu-cra-compliance/implementation-status.md.
gh aw add githubnext/gh-aw-cao/eu-cra-complianceConfigure the shared GitHub App or PAT described in the authentication guide, then declare the campaign and workers in .github/workflows/cao.json:
{
"version": 1,
"control-plane": {
"campaigns": {
"eu-cra-compliance": {
"workers": {
"scope-classifier": {
"workflow": "eu-cra-compliance-scope-classifier"
},
"security-requirements-auditor": {
"workflow": "eu-cra-compliance-security-requirements-auditor"
},
"supply-chain-sbom-auditor": {
"workflow": "eu-cra-compliance-supply-chain-sbom-auditor"
},
"vulnerability-handling-auditor": {
"workflow": "eu-cra-compliance-vulnerability-handling-auditor"
},
"article-14-reporting-readiness": {
"workflow": "eu-cra-compliance-article-14-reporting-readiness"
},
"conformity-release-evidence": {
"workflow": "eu-cra-compliance-conformity-release-evidence"
}
}
}
}
}
}The omitted fields default to an enabled campaign and workers, review mode, one repository, and 100 percent rollout. Each worker may set its own enabled and max-mode fields. Promote to limited live only after reviewing evidence handling and credential access.
- The orchestrator selects repositories but performs no CRA analysis.
- Workers treat target content as untrusted and use read-only GitHub permissions.
- Visible results use declared safe outputs; no worker contacts a regulator.
- Material scope, classification, role, conformity, reporting, declaration, and release decisions require explicit human review.
- Findings use bounded evidence statuses, never compliance, certification, or CE approval claims.
- Regulatory dates and interpretations are verified against current authoritative sources; non-binding guidance is labeled.
- All campaign agents use Pi with the GitHub Copilot backend through the CLI and GitHub proxies.
Direct checkouts include frozen operational graders, registered through gh-aw's operational-value protocol, for all six repository workers and the campaign maintainer. gh aw add transports the focused campaign's workflow-local campaign-maintainer grader with the installed workflow.