auths-dev/Verify with Auths

Verify cryptographic commit and artifact signatures on every PR using Auths identity keys.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 20, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: auths-dev/verify@c7bee200ff881005bd13bd67f514b57edbfd0500 # v1.4.2

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
identity-bundle	Identity bundle for stateless verification. Accepts: identity bundle JSON, CI token JSON, or a file path to a bundle (e.g. .auths/ci-bundle.json). Leave empty for KEL-native verification against the local identity store. Generate one with `auths id export-bundle`.	no	""
commits	Git commit range to verify (defaults to PR commits or push commits)	no	""
auths-version	Auths CLI version to pin (e.g. "0.1.3"). Required unless `auths` is already on PATH — a verification action must not resolve `latest` (supply-chain hardening). The pinned release must publish a `.sha256` checksum.	no	""
fail-on-unsigned	Whether to fail the action if unsigned commits are found	no	true
skip-merge-commits	Whether to skip merge commits during verification	no	true
post-pr-comment	Post a PR comment with verification results and fix instructions (requires pull-requests: write)	no	false
github-token	GitHub token used to post the PR comment (required when post-pr-comment is true)	no	""
files	Glob patterns for artifact files to verify, one per line (e.g., "dist/*.tar.gz")	no	""
artifact-attestation-dir	Directory containing .auths.json attestation files (default: alongside artifacts)	no	""
fail-on-unattested	Fail the action if any artifact lacks a valid attestation	no	true

Outputs

name	description
verified	Whether all commits were verified successfully
results	JSON array of per-commit verification results
total	Total number of commits checked
passed	Number of commits that passed verification
failed	Number of commits that failed verification
artifacts-verified	Whether all artifacts were verified (true/false)
artifact-results	JSON array of per-artifact verification results