corvidlabs/attest verify
Gate a commit range against an .attest.json policy; fail on any violation. Installs a prebuilt attest, no Swift needed.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 7, 2026
- License
- MIT
Pinned Snippet
uses: corvidlabs/attest@e8a2d928eb4b9a33185c32ba7b8e9b3a985987f2 # 1.0.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| range | Git range to verify, e.g. 'origin/main..HEAD'. Requires full history (checkout with fetch-depth: 0). | no | origin/main..HEAD |
| policy | Path to the policy file, relative to working-directory. | no | .attest.json |
| forward-from | Optional reviewed source commit whose provenance should be forwarded to the landed commit before verification. | no | "" |
| forward-to | Landed commit to attest when forward-from is set. | no | HEAD |
| forward-reviewer | Reviewer identity to record on the forwarded attestation. | no | ci:attest-forward |
| forward-sign | Whether to sign the forwarded attestation with the runner's attest key. | no | false |
| working-directory | Directory to run attest in (the repository to verify). | no | . |
| version | attest release to install (e.g. 0.3.0 or v0.3.0), or "latest". Defaults to the ref this action was pinned to when that is a release tag, otherwise "latest". | no | "" |
Outputs
| name | description |
|---|---|
| binary | Absolute path to the attest binary used. |