4x0v7/Verify Git object
Verify a git object (commit/tag) signature
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stalelast commit Feb 20, 2022
- License
- None
Pinned Snippet
uses: 4x0v7/ghaction-verify-gitobj@c660bb181c34add48b7e6d99df581e2a89a61ab4 # v0.2.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| repo | git repository to validate | no | self |
| ref | A git ref, eg. refs/heads/main, HEAD, v0.1.0, 2965f6b | yes | — |
| tag | an annotated or lightweight tag | no | — |
| pubkey | Public key of the object signer which validates the signature | no | — |
| pubkey_url | URL to a public key file (ex. https://github.com/web-flow.gpg) | no | https://github.com/web-flow.gpg |
| pubkey_url_hash | SHA256 hash of the public key file (generate by hashing the public key after inspecting it) | no | — |
Outputs
| name | description |
|---|---|
| signed | bool of result |
| ref | git ref that was passed in to verify |
| commit | git commit sha of ref |
| signer_name | Name of the signer |
| signer_email | Email address of the signer |
| signature_date | Date the signature was made in ISO-8601 format |
| signer_fingerprint | Signer gpg key full fingerprint |
| signer_longid | Signer gpg key in long format |