gobeyondidentity/Authorize Commit Signing

Verify signature of a signed commit using Beyond Identity.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Maintainedlast commit Dec 22, 2025
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: gobeyondidentity/auth-commit-sig@6db65836b90626777616f62faa2b33a9e8b836da # v1.0.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
api_token	API token for the Beyond Identity key management API. Should be stored as a secret in your repository, and referenced as, e.g. api_token: {{ secrets.BYNDID_KEY_MGMT_API_TOKEN }}	yes	—
repository	The repository which the signature verification action is performed on. This is also used to match against the repositories listed on the allowlist.	yes	—
ref	The commit reference to check. Defaults to HEAD, which will be the ref checked out by `actions/checkout`.	no	HEAD
allowlist_config_file_path	The file path where the allowlist config file is stored. See README on how to configure and fetch allowlist.	no	—

Outputs

name	description
outcome	The outcome is a JSON blob containing details about the outcome of the action. It contains information about the commit, if signature verification was successful, if an allowlist email address or third party key was used, errors, and other details.