colek42/witness-run
Creates Attestation of CI Process with Witness
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| action-ref | Reference to a GitHub Action to run (format: owner/repo@ref). If provided, command is ignored. | no | — |
| command | command to run (not needed if action-ref is provided) | no | — |
| step | Name of the step being run | yes | — |
| witness_version | Version of Witness CLI | no | 0.8.1 |
| witness-args | Additional command-line arguments to pass to Witness (space-separated). Useful for undocumented or future options not yet supported explicitly by this action. | no | — |
| outfile | File to which to write signed data | no | — |
| witness_trace | Enable tracing for the command | no | false |
| workingdir | Directory from which commands will run | no | — |
| attestations | Attestations to record ('product' and 'material' are always recorded) | no | environment git github |
| enable-archivista | Use Archivista to store or retrieve attestations | no | true |
| archivista-server | URL of the Archivista server to store or retrieve attestations | no | https://archivista.testifysec.io |
| attestor-link-export | Export the Link predicate in its own attestation | no | false |
| attestor-maven-pom-path | Path to the Maven POM file | no | — |
| attestor-sbom-export | Export the SBOM predicate in its own attestation | no | false |
| attestor-slsa-export | Export the SLSA provenance predicate in its own attestation | no | false |
| product-exclude-glob | Pattern to use when recording products. Files that match this pattern will be excluded as subjects on the attestation. | no | — |
| product-include-glob | Pattern to use when recording products. Files that match this pattern will be included as subjects on the attestation. | no | * |
| enable-sigstore | Use Sigstore for attestation | no | true |
| fulcio | Fulcio address to sign with | no | — |
| fulcio-oidc-client-id | OIDC client ID to use for authentication | no | — |
| fulcio-oidc-issuer | OIDC issuer to use for authentication | no | — |
| fulcio-oidc-redirect-url | OIDC redirect URL (Optional). The default oidc-redirect-url is 'http://localhost:0/auth/callback' | no | — |
| fulcio-token | Raw token string to use for authentication to fulcio | no | — |
| fulcio-token-path | Path to the file containing a raw token to use for authentication to fulcio | no | — |
| certificate | Path to the signing key's certificate | no | — |
| key | Path to the signing key | no | — |
| intermediates | Intermediates that link trust back to a root of trust in the policy | no | — |
| kms-aws-config-file | The shared configuration file to use with the AWS KMS signer provider | no | — |
| kms-aws-credentials-file | The shared credentials file to use with the AWS KMS signer provider | no | — |
| kms-aws-insecure-skip-verify | Skip verification of the server's certificate chain and host name | no | false |
| kms-aws-profile | The shared configuration profile to use with the AWS KMS signer provider | no | — |
| kms-aws-remote-verify | Verify signature using AWS KMS remote verification. If false, the public key will be pulled from AWS KMS and verification will take place locally | no | true |
| kms-gcp-credentials-file | The credentials file to use with the GCP KMS signer provider | no | — |
| kms-hash-type | The hash type to use for signing | no | sha256 |
| kms-key-version | The key version to use for signing | no | — |
| kms-ref | The KMS Reference URI to use for connecting to the KMS service | no | — |
| spiffe-socket | Path to the SPIFFE Workload API socket | no | — |
| vault-altnames | Alt names to use for the generated certificate. All alt names must be allowed by the vault role policy | no | — |
| vault-commonname | Common name to use for the generated certificate. Must be allowed by the vault role policy | no | — |
| vault-namespace | Vault namespace to use | no | — |
| vault-pki-secrets-engine-path | Path to the Vault PKI Secrets Engine to use | no | pki |
| vault-role | Name of the Vault role to generate the certificate for | no | — |
| vault-token | Token to use to connect to Vault | no | — |
| vault-ttl | Time to live for the generated certificate. Defaults to the vault role policy's configured TTL if not provided | no | — |
| vault-url | Base url of the Vault instance to connect to | no | — |
| timestamp-servers | Timestamp Authority Servers to use when signing envelope | no | — |
| hashes | Hashes selected for digest calculation (space separated) | no | sha256 |
| env-add-sensitive-key | Add keys or globs (e.g. '*TEXT') to the list of sensitive environment keys | no | — |
| env-disable-default-sensitive-vars | Disable the default list of sensitive vars and only use the items mentioned by --add-sensitive-key | no | false |
| env-exclude-sensitive-key | Exclude specific keys from the list of sensitive environment keys. Does not support globs | no | — |
| env-filter-sensitive-vars | Switch from obfuscate to filtering variables which removes them from the output completely | no | false |
| dirhash-glob | Dirhash glob can be used to collapse material and product hashes on matching directory matches | no | — |
| * | Any other input | no | — |
Outputs
no outputs