illuminatiltd-ai/NKS SSH Certificate
Request short-lived SSH certificates from Neural Key Service for CI/CD deployments.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 28, 2026
- License
- MIT
Pinned Snippet
uses: illuminatiltd-ai/nks-ssh-cert@0ec448a18a02c571510976300d86be5cf08e5dff # v1.0.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| api-key | NKS API key. Store this in GitHub Actions secrets. | yes | — |
| api-url | NKS API base URL. | no | https://crm.illuminati.co.il |
| host | NKS host identifier to request a certificate for. | yes | — |
| principal | SSH principal/user to authenticate as on the target host. | yes | — |
| ttl-minutes | Certificate TTL in minutes. NKS currently accepts 1-60. | no | 15 |
| services | Optional comma-separated service labels for forward-compatible workflow metadata. | no | "" |
| key-path | Optional path for the generated Ed25519 private key. Defaults under RUNNER_TEMP. | no | "" |
| certificate-path | Optional path for the signed OpenSSH certificate. Defaults to <key-path>-cert.pub. | no | "" |
| comment | SSH key comment. | no | nks-github-actions |
Outputs
| name | description |
|---|---|
| certificate | Signed OpenSSH certificate content. |
| certificate-path | Path to the signed OpenSSH certificate file. |
| private-key | Path to the generated private key. The private key content is not exposed as an output. |
| private-key-path | Path to the generated private key. |
| public-key | Generated OpenSSH public key content. |
| public-key-path | Path to the generated OpenSSH public key file. |
| serial | NKS certificate serial number. |
| expires-at | ISO timestamp when the certificate expires. |
| principal | SSH principal confirmed by NKS. |
| host | NKS host confirmed by NKS. |