actions-marketplace-validations/Authorize Commit Signing
Verify signature of a signed commit using Beyond Identity.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Dec 22, 2025
- License
- Apache 2.0
Pinned Snippet
uses: actions-marketplace-validations/gobeyondidentity_auth-commit-sig@0fd7ffdf7be2a5dc1c7870f049ad4a5465074785 # no releases — HEAD as of 2026-07-12tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| api_token | API token for the Beyond Identity key management API. Should be stored as a secret in your repository, and referenced as, e.g. api_token: {{ secrets.BYNDID_KEY_MGMT_API_TOKEN }} | yes | — |
| repository | The repository which the signature verification action is performed on. This is also used to match against the repositories listed on the allowlist. | yes | — |
| ref | The commit reference to check. Defaults to HEAD, which will be the ref checked out by `actions/checkout`. | no | HEAD |
| allowlist_config_file_path | The file path where the allowlist config file is stored. See README on how to configure and fetch allowlist. | no | — |
Outputs
| name | description |
|---|---|
| outcome | The outcome is a JSON blob containing details about the outcome of the action. It contains information about the commit, if signature verification was successful, if an allowlist email address or third party key was used, errors, and other details. |