icl-ml4csec/Commit Verification
Verifies commit signatures for both repository commits and third-party dependencies
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| repository | The full GitHub repository (e.g. owner/repo) | yes | — |
| branch | The branch name | yes | — |
| token | GitHub token | yes | — |
| commits-to-check | Number of commits to check (or 'all') | no | all |
| time-range | Time-range duration for time-based checking (e.g. '6 months', '4320h'). Leave empty for no limit | no | 6 months |
| key-age-period | Check PGP key age (e.g. '730h', '1 week'). Leave empty for no requirement | no | "" |
| repo-policy | Repository policy (colon-separated:expired:email-mismatch:uncertified:missingkey:github-automated:unsigned:unregistered) | no | false:false:false:false:true:false:false |
| deps-policy | Dependencies policy (colon-separated:expired:email-mismatch:uncertified:missingkey:github-automated:unsigned:unregistered) | no | true:true:true:true:true:true:true |
| output-format | Output format ('json' or 'console') | no | console |
| output-file | Output file name for JSON reports | no | signature-report.json |
Outputs
no outputs