| files | Files to sign: glob patterns, one per line (or comma-separated). PE images (.exe, .dll, .sys, .ocx, .cpl, …) and Windows Installer packages (.msi, .msm, .msp); the format is detected from the file contents, not the extension. | yes | — |
| email | Certum account e-mail. Falls back to $CERTUM_EMAIL. | no | — |
| otp-seed | TOTP seed of the SimplySign authenticator: a base32 secret or the full otpauth:// URI. Long-lived — keep it in a protected environment secret. Falls back to $CERTUM_OTP. Mutually exclusive with otp-code. | no | — |
| otp-code | A current 6-digit code from the SimplySign authenticator, for a one-off run without handing the seed to CI. Falls back to $CERTUM_TOKEN. | no | — |
| timestamp-url | RFC 3161 timestamp authority. An empty string disables timestamping (not recommended). | no | http://time.certum.pl/ |
| description | Program name embedded in the signature (what Windows shows as the signed item). | no | — |
| url | Information URL embedded in the signature. | no | — |
| output-dir | Write the signed files here (same base names) instead of replacing the inputs in place. | no | — |
| backup | When signing in place, keep the original next to it as <file>.orig. | no | false |
| replace-existing-signature | Strip and replace an existing Authenticode signature instead of failing on it. | no | false |
| chain-file | PEM bundle with additional intermediate certificates to embed. The Certum Code Signing 2021 CA is built in. | no | — |
| card-serial | Serial (cardno) of the SimplySign card to sign with, when the account has several. | no | — |
| verify | Re-parse and cryptographically verify every signed file before it is written. | no | true |
| allow-pull-request | Permit running on pull_request events. Off by default: signing must never be triggerable by a PR. | no | false |
| fail-on-no-files | Fail when the patterns match no file. | no | true |