actions/Package and Publish
Publish actions as OCI artifacts to GHCR
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stalelast commit Oct 22, 2024
- License
- MIT
Pinned Snippet
uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | The GitHub actions token used to authenticate with GitHub APIs | — | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| package-manifest-sha | A sha256 hash of the package manifest |
| attestation-manifest-sha | The sha256 of the provenance attestation uploaded to GHCR. This is not present if the package is not attested, e.g. in enterprise environments. |
| referrer-index-manifest-sha | The sha256 of the referrer index uploaded to GHCR. This is not present if the package is not attested, e.g. in enterprise environments. |