cvemula1/TIF Trust Gate
Verify container image trust — signatures, SBOMs, attestations, vulnerabilities, and compliance in one step
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| image | Container image reference to verify (e.g. registry.io/app:1.0) | yes | — |
| version | TIF version to install (default: latest) | no | "" |
| policy-pack | Built-in policy pack: default, cis-l1, cis-l2, nist-800-190, dod-stig | no | default |
| fail-on | Fail if vulnerability at this severity or higher (critical, high, medium, low) | no | critical |
| require-sbom | Fail if no SBOM attached | no | false |
| require-provenance | Fail if no SLSA provenance | no | false |
| format | Output format (table, json) | no | table |
| cosign-key | Path to cosign public key (default: keyless Sigstore) | no | "" |
Outputs
no outputs