johnbillion/WordPress Plugin Attestation

Generates an attestation for the build provenance of a plugin published on the wordpress.org plugin directory

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Activelast commit May 24, 2026
License
MIT

Pinned Snippet

workflow.ymlSHA-pinned
uses: johnbillion/action-wordpress-plugin-attestation@4bab69a053ffbafd35deba3eba557e429e6f19ea # 0.7.3

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
zip-pathThe local path to the plugin zip file.yes
pluginOptional. The plugin slug.no${{ github.event.repository.name }}
versionOptional. The version number of the release.no${{ github.ref_name }}
timeoutOptional. The maximum time in minutes to wait for the plugin zip to become available in the plugin directory.no60
zip-urlOptional. The URL where the plugin zip file is hosted (for platforms other than wordpress.org).nohttps://downloads.wordpress.org/plugin/%plugin%.%version%.zip
dry-runOptional. Set this to true to skip generating the actual attestation.nofalse
namedescription
bundle-pathAbsolute path to the file containing the generated attestation.
attestation-idGitHub ID for the attestation.
attestation-urlURL for the attestation summary.
zip-urlURL where the plugin zip file is hosted.
zip-sha-256SHA-256 hash of the downloaded plugin zip file.