CMS-0057-F CI templates (GitHub Actions conformance gates)

Ready-to-copy GitHub Actions workflows that gate a CMS-0057-F FHIR endpoint on structural conformance: install the pidgeon CLI, install the IG package, run pidgeon conform --walk --ci against the live endpoint, and archive a dated scorecard plus a pass/fail badge as build artifacts. One workflow per IG (US Core 6.1, Da Vinci PAS 2.1, CRD 2.1, DTR 2.0), plus a release-triggered re-test that leaves a dated scorecard on every release. Version labels: the rule's required baseline names US Core 3.1.1 (45 CFR 170.215 as adopted); US Core 6.1 is the ecosystem target these gates default to, and the Da Vinci IGs are recommended, not required.

Example

# US Core Patient Access conformance gate — prove a Patient Access FHIR endpoint
# passes US Core STU 6.1 (USCDI v3) from CI, with a dated scorecard and a pass/fail
# badge as build artifacts.
#
# Setup:
#   1. Copy this file to .github/workflows/conform-us-core.yml in your repo.
#   2. Set the FHIR_ENDPOINT and FHIR_TOKEN repository secrets.

name: conform — US Core patient access

on:
  pull_request:
  workflow_dispatch:

jobs:
  conform:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'

      - name: Install pidgeon
        run: dotnet tool install -g pidgeon

      - name: Install the US Core IG package
        run: pidgeon data install fhir-us-core-6.0

      - name: Gate the endpoint on US Core conformance
        run: |
          pidgeon conform \
            --endpoint ${{ secrets.FHIR_ENDPOINT }} \
            --ig http://hl7.org/fhir/us/core/ \
            --walk --ci \
            --auth "Bearer ${{ secrets.FHIR_TOKEN }}" \
            --output-format html \
            --output-file ./scorecard-us-core-${{ github.run_number }}.html \
            --badge ./conform-badge.svg

      - name: Publish scorecard + badge
        if: always()   # archive even when the conformance gate fails
        uses: actions/upload-artifact@v4
        with:
          name: conform-us-core-${{ github.run_number }}
          path: |
            ./scorecard-*.html
            ./conform-badge.svg
          retention-days: 365

# ---------------------------------------------------------------------------
# Da Vinci PAS variant: swap the install and the walk scope.
#
#   - run: pidgeon data install fhir-davinci-pas-2.1
#   - run: |
#       pidgeon conform \
#         --endpoint ${{ secrets.FHIR_ENDPOINT }} \
#         --ig http://hl7.org/fhir/us/davinci-pas/ \
#         --walk --ci \
#         --auth "Bearer ${{ secrets.FHIR_TOKEN }}"
#
# CRD 2.1 and DTR 2.0 gates are the same two-line swap:
#   fhir-davinci-crd-2.1  with  --ig http://hl7.org/fhir/us/davinci-crd/
#   fhir-davinci-dtr-2.0  with  --ig http://hl7.org/fhir/us/davinci-dtr/
#
# Release re-test variant: replace the `on:` block so every published release
# leaves a dated, IG-versioned scorecard as a 365-day artifact:
#
#   on:
#     release:
#       types: [published]
#     workflow_dispatch:

The workflow is the shipped Pidgeon starter template, reproduced whole; the commented variants name the exact two-line swaps for the other three IG gates and the release re-test trigger. Each run produces structural conformance evidence with a non-zero exit code a pipeline can gate on; the scorecard stamps the exact IG versions graded against.

Validation context

Strict and compatibility validation notes land here with the phase-1 data export.