hikaruegashira/gh-verify

GitHub SDLC health checker. Verifies pull requests and releases against supply chain security and compliance controls.

Trust Signals

workflow.ymlSHA-pinned

uses: hikaruegashira/gh-verify@96203c3dc4be07e27aaf340566ebae2198084310 # v0.19.0

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
command	Subcommand: pr, repo, or release	yes	—
argument	PR number (for pr), git ref (for repo), or tag/range (for release). Optional for repo.	no	""
repo	Repository in OWNER/REPO format (defaults to current repo)	no	${{ github.repository }}
format	Output format: human, json, or sarif	no	json
policy	Policy preset (default, oss, aiops, soc1, soc2, slsa-l1..l4, ismap, pci-dss, tisax, nist-800-53, wp29) or path to .rego file	no	""
only-failures	Only show controls with fail decision in output	no	false
exclude	Comma-separated control IDs to exclude from results	no	""
with-evidence	Include raw collected evidence in JSON/SARIF output	no	false
version	gh-verify version to install. Empty = latest.	no	""
upload-sarif	Upload SARIF results to GitHub Code Scanning (auto-enabled when format=sarif)	no	false
audit	Report results without failing the workflow (always exit 0). Useful for gradual rollout	no	false
only	Comma-separated control IDs to include (all others excluded). See 'gh verify controls'	no	""

name	description
result	Overall gate result: pass, review, or fail
exit-code	Raw exit code from gh-verify: 0=pass, 1=verification failure, 2=infrastructure error
pass-count	Number of controls with pass decision
review-count	Number of controls with review decision
fail-count	Number of controls with fail decision
sarif-file	Path to SARIF output file (set when SARIF is generated)