johnbillion/WordPress Plugin Attestation
Generates an attestation for the build provenance of a plugin published on the wordpress.org plugin directory
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit May 24, 2026
- License
- MIT
Pinned Snippet
uses: johnbillion/action-wordpress-plugin-attestation@4bab69a053ffbafd35deba3eba557e429e6f19ea # 0.7.3tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| zip-path | The local path to the plugin zip file. | yes | — |
| plugin | Optional. The plugin slug. | no | ${{ github.event.repository.name }} |
| version | Optional. The version number of the release. | no | ${{ github.ref_name }} |
| timeout | Optional. The maximum time in minutes to wait for the plugin zip to become available in the plugin directory. | no | 60 |
| zip-url | Optional. The URL where the plugin zip file is hosted (for platforms other than wordpress.org). | no | https://downloads.wordpress.org/plugin/%plugin%.%version%.zip |
| dry-run | Optional. Set this to true to skip generating the actual attestation. | no | false |
Outputs
| name | description |
|---|---|
| bundle-path | Absolute path to the file containing the generated attestation. |
| attestation-id | GitHub ID for the attestation. |
| attestation-url | URL for the attestation summary. |
| zip-url | URL where the plugin zip file is hosted. |
| zip-sha-256 | SHA-256 hash of the downloaded plugin zip file. |