crazygrl24/mfp

Generate provenance attestations for build artifacts

Trust Signals

name	description	required	default
subject-path	Path to the artifact serving as the subject of the attestation. Must specify exactly one of "subject-path" or "subject-digest". May contain a glob pattern or list of paths (total subject count cannot exceed 2500).	no	—
subject-digest	Digest of the subject for which provenance will be generated. Must be in the form "algorithm:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one of "subject-path" or "subject-digest".	no	—
subject-name	Subject name as it should appear in the provenance statement. Required unless "subject-path" is specified, in which case it will be inferred from the path.	—	—
push-to-registry	Whether to push the provenance statement to the image registry. Requires that the "subject-name" parameter specify the fully-qualified image name and that the "subject-digest" parameter be specified. Defaults to false.	no	false
show-summary	Whether to attach a list of generated attestations to the workflow run summary page. Defaults to true.	no	true
github-token	The GitHub token used to make authenticated API requests.	no	${{ github.token }}

name	description
bundle-path	The path to the file containing the attestation bundle(s).