intyga-dev/Intyga — Require Human Approval
Gate a workflow on a cryptographically-signed human approval, verified offline. No app code changes.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| gateway-url | Intyga gateway base URL. | yes | — |
| client-id | SERVICE-identity API key client id (so the pipeline REQUESTS and a human APPROVES → separation of duties). | yes | — |
| client-secret | SERVICE-identity API key secret. | yes | — |
| action-description | Human-readable description shown to the approver (WYSIWYS). | yes | — |
| target | The execution target — the environment/RP this approval is for, e.g. prod-cluster-01. Bound into the signed payload (DIV Target Isolation) so an approval cannot be replayed against a different target. | yes | — |
| action-type | Stable action identifier bound into the signed payload, e.g. deploy_production. | yes | — |
| approver-keys | Comma-separated base64 approver public keys THIS pipeline trusts, resolved from your own key management. Required to verify the receipt — a receipt cannot vouch for its own signer. | no | "" |
| approvers-json | The trusted approvers as an `intyga-trust-anchor` JSON document (exported from your INTYGA console under Approvals), as an alternative to approver-keys. It names PEOPLE with their keys, so a quorum counts people rather than keys, and it carries the console origin and RP ID. Store it as a repository variable you review, never something the pipeline fetches from the gateway. Give either this or approver-keys, not both. | no | "" |
| required-approvals | The minimum number of independent human approvals YOUR policy demands. A receipt whose own signed requirement is weaker is refused, so the requirement cannot be lowered by whoever composes the signed bytes (DIV section 5 step 3d). Strongly recommended. | no | "" |
| request-id | Set to "true" to add a fresh random approvalRequestId to the signed params, so this run's approval cannot be reused for another run. The Action passes the same params to the await step itself. | no | false |
| evidence-file | Path to write a JSON evidence file (the receipt, what was expected, the trust anchor, the verification result and whether it was consumed). Written with mode 0600. | no | "" |
| webauthn-origin | Origin of the approval console the human signs in (e.g. https://console.example.com). REQUIRED for passkey receipts — the verifier fails closed without it. | no | "" |
| webauthn-rp-id | Relying-party ID of the approval console (e.g. console.example.com). REQUIRED for passkey receipts, together with webauthn-origin. | no | "" |
| params | JSON object of the exact parameters that will execute (bound into the signature). | no | {} |
| web-url | Base URL of the Intyga console that hosts the /approve page (where the human signs). | yes | — |
| timeout | Seconds to wait for the human to approve before failing the job. | no | 600 |
| consume | Single-use: mark the approval consumed once verified (recommended). | no | true |
| slack-webhook | Optional Slack Incoming Webhook URL. If set, posts an interactive 'Approve' message. | no | "" |
| teams-webhook | Optional Microsoft Teams Incoming Webhook URL. If set, posts an 'Approve' card. | no | "" |
| sdk-version | Version of @intyga/sdk this Action runs via npx. Defaults to the version this Action release was built and tested against. Override only to pin backwards; prefer bumping the Action. | no | 1.1.0 |
| verify-version | Version of @intyga/verify, the offline verifier that checks the receipt. Defaults to the version this Action release was built and tested against. | no | 1.1.0 |
Outputs
no outputs