blairham/Stevedore

Build, scan, sign, and release Docker/OCI images with stevedore — installs every tool it needs.

Trust Signals

name	description	required	default
command	stevedore subcommand to run (release, plan, build, check, verify, doctor).	no	release
args	Additional arguments appended to the command, e.g. '--snapshot --only-changed'.	no	""
config	Path to the stevedore config file (passed as -f). Autodiscovered when empty.	no	""
version	stevedore release to download (a tag like v0.0.0, or 'latest').	no	latest
install-stevedore	Download the stevedore release binary. Set false if it's already on PATH.	no	true
working-directory	Directory to run stevedore in.	no	.
setup-buildx	Set up docker buildx. Disable if a previous step already did.	no	true
install-cosign	Install cosign (needed when sign.cosign.enabled).	no	true
install-syft	Install syft (needed when sbom.enabled).	no	true
install-grype	Install grype (needed when scan.enabled with scanner: grype).	no	true
install-crane	Install crane (needed when versioning.strategy: registry).	no	false

name	description
plan	The JSON build plan emitted by `command: plan` (matrix mode); empty for other commands.
summary	Compact JSON release summary ({project, images: [{id, version, digest, repositories, pushed, skipped, reason, …}]}) written by `command: release`/`build`; empty for other commands. Filter on `pushed` before notifying downstream systems.