brokenbots/Publish Criteria adapter

Publish a PRE-BUILT Criteria adapter binary as a signed OCI artifact (manifest emit -> OCI artifact construction -> cosign signature -> push). Building the adapter binary is the adapter's own job (toolchain-specific); this action only performs the publish steps.

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Stale
License
None

Inputs

namedescriptionrequireddefault
binaryPath to the pre-built adapter artifact your CI produced. Either a single binary (single-platform publish) OR a directory laid out as bin/<os>/<arch>/<binary> for a multi-platform publish (one OCI artifact with a binary layer per platform). For multi-platform, include the publish runner's own platform (e.g. linux/amd64) so the manifest can be emitted. yes—
registryFully-qualified target OCI reference, e.g. ghcr.io/org/name:1.2.3yes—
sign-keyOptional path to a PEM Ed25519 cosign signing key. When set, the published artifact is signed with that explicit key and the signature is attached as an OCI referrer. Mutually exclusive with keyless (takes precedence). no""
keylessSign keyless via Sigstore Fulcio using the workflow's ambient OIDC identity (the default signing path — requires `id-token: write`). Ignored when sign-key is set. Set to "false" to publish unsigned. notrue
imageOptional reference of an already-built, already-pushed runnable container image to record in the manifest (e.g. ghcr.io/org/name:1.2.3-image). The adapter's own CI builds and pushes the image (its Dockerfile); this action only records the resolved digest so the host can run it under environment.runtime. Default: artifact-only, no image. no""
criteria-refGit ref of brokenbots/criteria to build the `criteria` CLI from. TEMPORARY: the CLI is built from source until the v2 release ships. After v2 is tagged, switch to downloading a pinned release binary instead — see the "Switching to a released CLI" section in the README. noadapter-v2

Outputs

no outputs