jsalvata/lockfile-assay
Verify the committed lockfile derives honestly from reviewable inputs, post the verdict as the App's check run, and memoise passing derivations (anchored form — spec §8). Safe only from an anchored pull_request_target workflow — see docs/setup-github-app.md.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| base | Base ref (the PR merge-base), e.g. the origin merge-base; see examples/lockfile-assay.yml. | yes | — |
| head | Head ref to check — the PR head SHA; see examples/lockfile-assay.yml. | no | HEAD |
| pr | PR number, for the memo consult; see examples/lockfile-assay.yml. | yes | — |
| app-id | The dedicated App's id, for the consult identity filter. | yes | — |
| app-token | GitHub App installation token with Checks: write, from the dedicated App (actions/create-github-app-token). Passed to the CLI as LOCKFILE_ASSAY_TOKEN. See docs/setup-github-app.md. | yes | — |
Outputs
no outputs