astoltz/SourceGuardian Action

Protects PHP scripts by compiling them with SourceGuardian.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Maintainedlast commit Dec 13, 2025
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: astoltz/sourceguardian-encode-action@f88fea564ba42968ecfcc0e8cecf791a9a408c8b # no releases — HEAD as of 2026-07-13

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
source	The source directory or file mask to process (e.g., "src", "src/*.php").	yes	—
destination	The output directory for encoded files. Source files remain unchanged.	yes	—
sourceguardian_path	The directory containing the sourceguardian executable. Defaults to searching the system PATH.	no	—
phpversion	A multiline list of PHP versions to compile for (e.g., 8.3, 7.4+). Defaults to 8.3.	no	8.3
expire	Expiration date (dd/mm/yyyy) or period from now (e.g., 10d, 1d12h, 90m).	no	—
domain	A multiline list of domain names to bind the script to. Cannot be used with `domain-encrypt`.	no	—
domain-encrypt	Bind and encrypt script to a single domain name. Cannot be used with `domain`.	no	—
domain-ignore-cli	Ignore domain name check for CLI.	no	false
ip	A multiline list of IP addresses/masks to bind the script to. Cannot be used with `ip-encrypt`.	no	—
ip-encrypt	Bind and encrypt script to a single IP address/mask. Cannot be used with `ip`.	no	—
ip-ignore-cli	Ignore IP check for CLI.	no	false
mac	A multiline list of MAC addresses to bind the script to.	no	—
machine-id	A multiline list of machine IDs to bind the script to. Cannot be used with `machine-id-encrypt`.	no	—
machine-id-encrypt	Bind and encrypt script to a single machine ID. Cannot be used with `machine-id`.	no	—
remote-verification-url	URL for remote machine ID verification for CLI scripts.	no	—
external	Comma-separated list of license filenames, paths, or URLs. Requires `projid` and `projkey`. Cannot be used with other locking options.	no	—
conj	Make scripts work only with other encoded files.	no	false
projid	Project ID. Required when using `external`.	no	—
projkey	Project Key. Required when using `external`. Use a GitHub secret.	no	—
time-server	Comma-separated list of time servers for expiration checks (e.g., "pool.ntp.org,time.nist.gov").	no	—
const	A multiline list of custom defined constants (e.g., "name=value").	no	—
catch	A multiline list of custom error handlers (e.g., "ERR_EXPIRED=my_handler").	no	—
auto-global	A multiline list of custom auto-global variable names.	no	—
asp-tags	Enable the use of ASP-like <% %> tags.	no	false
no-short-tags	Disable the use of short PHP <? ?> tags.	no	false
prepend-code	Custom header code to add to the top of every encoded file (e.g., "code" or "@file.php").	no	—
loader-error-code	Custom code to execute if the SourceGuardian loader is not found (e.g., "code" or "@file.php").	no	—
no-default-starter	Do not integrate the default starter code for loader discovery.	no	false
compression-level	Compression level from 0 (fastest) to 9 (maximum).	no	—
entangle	PRO Entangling mode X with granularity Y (e.g., "7" or "7,4").	no	—
compat	Enable PHP 8.4+ compatibility mode.	no	false
eval-compatible	Enable eval() compatibility for encoded scripts.	no	false
stop-on-error	Stop encoding on the first critical error.	no	false
strict-errors	Report E_STRICT compiler errors.	no	false
deprec-errors	Report E_DEPRECATED PHP 5.3+ compiler errors.	no	false
keep-file-date	Keep the original modification date for encoded files.	no	false
keep-doc-comments	Keep doc comments within encoded files.	no	false
backup	Set backup file extension (e.g., "bak") or set to `false` to disable backups.	no	—
recursive	Recursively process files. Set to `false` to disable. Set to a number > 0 to strip that many directories from the target path.	no	0
files_to_exclude	A multiline list of file masks to exclude from processing entirely.	no	—
files_to_encode	A multiline list of file masks to encode as PHP. If used, other files matching the source are copied as-is.	no	—
files_to_encode_as_custom	A multiline list of file masks to encode as custom non-PHP files.	no	—
files_to_copy	A multiline list of file masks to copy without encoding.	no	—
encode-newer-than	Only encode files newer than the specified date/time (YYYYMMDDhhmmss).	no	—
ignore-symlinks	Ignore symlinks while recursively scanning directories.	no	false
verbose	Set verbosity level: 0 (quiet), 1 (errors only), 2 (encoding log).	no	2
docker-socket	Path to the mapped docker socket for installing to a Docker container.	no	—
license-file	Path to the license file.	no	—
show-license-info	Output license information after encoding.	no	true
license-release	Release the license for this installation after encoding. Cannot be used with `license-dynamic`.	no	false
license-dynamic	Request a dynamic license. Requires username and password.	no	false
license-username	The username for a dynamic license request.	no	—
license-password	The password for a dynamic license request. Use a GitHub secret.	no	—

Outputs

name	description
sourceguardian_version	The version of the SourceGuardian encoder used.
sourceguardian_license	The license information for the SourceGuardian installation.