actions-marketplace-validations/gh-action-sigstore-python
Use sigstore-python to sign Python packages
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Mar 30, 2026
- License
- Apache 2.0
Pinned Snippet
uses: actions-marketplace-validations/sigstore_gh-action-sigstore-python@deaf1aac09e184c7029fb0144dbcbbe40c36920d # no releases — HEAD as of 2026-07-10tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| inputs | the files to sign, whitespace separated | no | "" |
| identity-token | the OIDC identity token to use | no | "" |
| oidc-client-id | the custom OpenID Connect client ID to use during OAuth2 | no | "" |
| oidc-client-secret | the custom OpenID Connect client secret to use during OAuth2 | no | "" |
| rekor-version | The Rekor transparency log instance version used during signing. Valid values are [1, 2]. Verifying clients must be compatible with the used Rekor version. Default rekor-version is 1, except when `staging` is enabled: then default rekor-version is 2. | no | "" |
| staging | use sigstore's staging instances, instead of the default production instances | no | false |
| verify | verify the generated signatures after signing | no | false |
| verify-cert-identity | verify the identity in the signing certificate's Subject Alternative Name required if `verify` is enabled; has no effect otherwise. | no | "" |
| verify-oidc-issuer | verify the issuer extension of the signing certificate required if `verify` is enabled; has no effect otherwise. | no | "" |
| upload-signing-artifacts | upload all signing artifacts as workflow artifacts | no | false |
| release-signing-artifacts | attach all signing artifacts as release assets | no | true |
| internal-be-careful-debug | run with debug logs (default false) | no | false |
Outputs
no outputs