denzuko/cimatrix — org.cispec conformance
Verify org.cispec Change Item attribution conformance in binaries, Rego gates, and SLSA attestations.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 2, 2026
- License
- None
Pinned Snippet
uses: denzuko/cimatrix@cf855289cbb4650f689cd1a92a066b36f6efc3e8 # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| binary | Path to compiled binary for binary | no | — |
| gate-dir | Directory of .rego gate files for gate | no | — |
| gate-file | Single .rego gate file for gate | no | — |
| gate-input | JSON input file for gate evaluation | no | — |
| slsa-provenance | Path to .intoto.jsonl provenance file for slsa | no | — |
| source-uri | Source repository URI for SLSA verification (e.g. github.com/org/repo) | no | — |
| builder-id | SLSA builder ID URI (optional) | no | — |
| sarif-output | Path to write SARIF report (uploaded as artefact) | no | cimatrix.sarif |
| offline | Skip remote gate bundle pull; use cached gates only | no | false |
| cimatrix-version | cimatrix release version to install | no | latest |
Outputs
| name | description |
|---|---|
| result | PASS or FAIL |
| violations | Number of conformance violations found |