gemaraproj/Publish Gemara OCI bundle
Assemble a root Gemara YAML into an OCI bundle, push to a registry, sign/verify, and optionally promote to a second registry. Uses go-gemara bundle SDK internally. Boolean flags use the strings "true" / "false".
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 8, 2026
- License
- Apache 2.0
Pinned Snippet
uses: gemaraproj/gemara-publish-action@db4f45f004fdbc02646ccad19d65d4043126baeb # v0.1.2tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| registry | Registry host (e.g. ghcr.io) | no | ghcr.io |
| repository | Repository path without registry (e.g. org/gemara/my-bundle) | yes | — |
| tag | Tag to push | yes | — |
| file | Root Gemara artifact YAML (Policy, Catalog, or Guidance), relative to working_directory | yes | — |
| username | Registry user | no | "" |
| password | Registry token | yes | — |
| validate | Run gemara.Load schema validation and cue vet against the authoritative Gemara CUE schemas before assemble. | no | true |
| bundle_version | Bundle format version | no | 1 |
| working_directory | Working directory (relative to repo root) for resolving the file input | no | . |
| oras_version | ORAS CLI version (no v prefix) | no | 1.2.0 |
| sign_source | Keyless-sign source digest after publish | no | true |
| verify_source | Verify source digest signature after sign/publish | no | true |
| promote_to_destination | Copy artifact from the source registry to destination_* (second registry). Use any OCI registry. | no | false |
| destination_registry | Promotion destination registry host (e.g. quay.io, ghcr.io, *.dkr.ecr.*.amazonaws.com). Required when promote_to_destination is true. | no | "" |
| destination_repository | Promotion image path without registry host (namespace/repository). | no | "" |
| destination_tag | Destination tag when promoting (defaults to source tag input when empty). | no | "" |
| destination_username | Credentials for destination registry (promotion push). | no | "" |
| destination_password | Token/password for destination registry (promotion). | no | "" |
| trust_mode | copy-only, copy-referrers, or resign destination | no | resign |
| sign_destination | Keyless-sign destination digest (usually true for trust_mode=resign) | no | true |
| verify_destination | Verify destination digest signature | no | true |
| allowed_identity_regex | Optional regex for certificate identity in cosign verify | no | "" |
| cosign_version | Cosign release version | no | v2.4.0 |
| cosign_certificate_oidc_issuer | Expected OIDC issuer for keyless cosign verify (override for non-GitHub Actions signing environments). | no | https://token.actions.githubusercontent.com |
Outputs
| name | description |
|---|---|
| digest | Source manifest digest (sha256:...) |
| source_ref | Published source reference with digest |
| source_digest | Published source digest |
| destination_ref | Destination reference with digest after promotion |
| destination_digest | Destination digest after promotion |
| trust_mode | Effective trust mode used for destination handling |
| verified_source | true when source verification step passed |
| verified_destination | true when destination verification step passed |