actionutils/Trusted Tag Verifier
Verify tags signed with Gitsign and display their contents
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| verify | The repository and tag to verify in the format <owner>/<repo>@<version> or <owner>/<repo> (auto-detects from downloaded action) | yes | — |
| fail-on-verification-error | Whether to fail the action if verification fails | no | true |
| certificate-oidc-issuer | The OIDC issuer to verify against | no | https://token.actions.githubusercontent.com |
| certificate-identity-regexp | The identity regexp to verify against | no | ^https://github.com/actionutils/trusted-tag-releaser |
Outputs
| name | description |
|---|---|
| verified | Whether the tag was successfully verified (true/false) |
| tlog-index | The Rekor transparency log index parsed from gitsign output |
| repository | The repository that was verified (e.g., owner/repo) |
| tag-name | The name of the verified tag |
| commit-sha | The SHA of the commit that the tag points to |
| tagger-name | The name of the tagger |
| tagger-email | The email of the tagger |
| tag-message | The message associated with the tag |
| verification-result | The complete verification result as a JSON string |