github-early-access/Generate Build Provenance
Generate provenance attestations for build artifacts
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | The GitHub token used to make authenticated API requests. | no | ${{ github.token }} |
| subject-path | Path to the artifact for which provenance will be generated. Must specify exactly one of "subject-path" or "subject-digest". | no | — |
| subject-digest | Digest of the subject for which provenance will be generated. Must be in the form "algorithm:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one of "subject-path" or "subject-digest". | no | — |
| subject-name | Subject name as it should appear in the provenance statement. Required unless "subject-path" is specified, in which case it will be inferred from the path. | — | — |
| push-to-registry | Whether to push the provenance statement to the image registry. Requires that the "subject-name" parameter specify the fully-qualified image name and that the "subject-digest" parameter be specified. Defaults to false. | no | false |
Outputs
| name | description |
|---|---|
| bundle | The JSON-serialized Sigstore bundle containing the signed provenance statement and related verification material. |