carabiner-dev/Verify AMPEL Policy
Verifies a software artifact against an 🔴🟡🟢 AMPEL supply chain policy
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| policy | Path or URI to the security policy file to evaluate against | yes | — |
| subject | Path to a file or hash (algo:value) to use as verification subject | yes | — |
| collector | Collector to load to read attestations | yes | — |
| attest | Attest the policy evaluation results | no | true |
| attest-format | Format of the results attestation | no | ampel |
| results-path | Path to store the results attestation | no | ampel.intoto.json |
| push-attestation | Pushes the attestation to the GitHub attestations store | no | false |
| attestation | Comma separated list of attestations to ingest | no | "" |
| signer | Comma separated list of signer identity slugs | no | "" |
| key | Path to a key file to use for verification | no | "" |
| keydata | Raw key material to use for verification | no | "" |
| context | Contextual values to pass to the policy (e.g. "key=value,key2=value2") | no | "" |
| fail | Fail the workflow if the policy fails | no | true |
Outputs
no outputs