anulum/SYNAPSE policy check
Check a SYNAPSE release receipt against a policy file in CI — optionally recomputing the receipt's coordination-log Merkle commitment and requiring a trusted hub signature over it.
View on GitHubTrust Signals
- Scorecard Score
- Scorecard 4–6scored Jul 13, 2026
- Maintenance Recency
- Activelast commit Jul 13, 2026
- License
- AGPL 3.0
Pinned Snippet
uses: anulum/synapse-channel@1fe757c749913bfecd385974915f2c581a537f34 # v0.99.5tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| task | Task id / subject label for the decision report. | yes | — |
| policy | Path to the policy file (.json always; .toml on Python 3.11+). | yes | — |
| receipt-json | Path to the release-receipt JSON (from `synapse release --receipt-json`). | yes | — |
| enforce | Exit non-zero when an enforcement-mode policy has a failing rule. The default gates the job; set "false" for an advisory, report-only run. | no | true |
| merkle-db | Hub event store to recompute the receipt's coordination-log commitment against; adds a merkle_commitment decision that fails when the committed log prefix changed. | no | "" |
| trusted-signing-keys | Trusted hub verification keys (.pub files from `synapse merkle keygen`), one path per line; adds a merkle_signature decision that fails unless a trusted key's signature verifies over the receipt's commitment. | no | "" |
| version | synapse-channel version to install (e.g. "0.88.0"); empty installs the latest release. Pin this for reproducible gating. | no | "" |
| python-version | Python version to run the check with. | no | 3.12 |
Outputs
| name | description |
|---|---|
| report | The JSON decision report `synapse policy-check --json` printed. |