developer982/Attest Build Provenance

Generate provenance attestations for build artifacts

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stalelast commit Oct 17, 2024
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: developer982/turbo-octo-disco@9ffae92c566fc782c7d9d69d97caed957b47717e # no releases — HEAD as of 2026-07-11

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
subject-path	Path to the artifact for which provenance will be generated. Must specify exactly one of "subject-path" or "subject-digest".	no	—
subject-digest	Digest of the subject for which provenance will be generated. Must be in the form "algorithm:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one of "subject-path" or "subject-digest".	no	—
subject-name	Subject name as it should appear in the provenance statement. Required unless "subject-path" is specified, in which case it will be inferred from the path.	—	—
push-to-registry	Whether to push the provenance statement to the image registry. Requires that the "subject-name" parameter specify the fully-qualified image name and that the "subject-digest" parameter be specified. Defaults to false.	no	false
github-token	The GitHub token used to make authenticated API requests.	no	${{ github.token }}

Outputs

name	description
bundle-path	The path to the file containing the attestation bundle(s).