electricapp/hasp

Scan GitHub Actions workflows for unpinned dependencies, phantom commits, and supply-chain risks

Trust Signals

name	description	required	default
version	hasp release version to download (e.g. v0.1.0). Changing this does NOT change the expected hash — you must update `expected-hash` to match.	no	v0.1.0
expected-hash	SHA256 hash of the hasp binary. The action will fail if the downloaded binary does not match. Update this when changing `version`. Get the hash from the release's .sha256 file.	no	4b2e4a075d0e89673122246ddf202b596fc909649158d8d1ff6d79561210d590
verify	Binary verification level. Each level includes all levels below it. sha256: checksum only (fast, no extra tools) sigstore: + Sigstore cosign signature (proves CI provenance) slsa: + SLSA build provenance attestation (proves exact commit)	no	slsa
mode	Scan mode: "default", "paranoid", or "strict". - default: pin verification only - paranoid: all security audits enabled - strict: mutable refs are failures + token required	no	paranoid
policy	Path to a .hasp.yml policy file. Leave empty to auto-detect from repository root. Set to "none" to disable policy loading.	no	""
args	Additional CLI arguments passed directly to hasp. Example: "--min-sha-age 48h --no-verify"	no	""
dir	Workflow directory to scan.	no	.github/workflows
cosign-version	Cosign version to install for Sigstore verification. Only used when verify is "sigstore" or "slsa".	no	v2.4.3
cosign-hash	SHA256 of the cosign binary. Verified before execution. Update when changing cosign-version.	no	caaad125acef1cb81d58dcdc454a1e429d09a750d1e9e2b3ed1aed8964454708

name	description
exit-code	hasp exit code (0 = pass, 1 = findings, 2 = error)
sha256	SHA256 hash of the verified hasp binary
sigstore-verified	Whether Sigstore signature was verified (true/false/skipped)
slsa-verified	Whether SLSA provenance was verified (true/false/skipped)