kiptoonkipkurui/provavalidator
Run provavalidator as a GitHub Action for provenance, SBOM, vulnerability, drift, and corpus workflows.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 28, 2026
- License
- None
Pinned Snippet
uses: kiptoonkipkurui/provavalidator@3a3e9ca461250a301d0fb81e24b29197070ff96f # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| mode | Execution mode: check, vuln, drift, attest, corpus, or args | no | check |
| image | Container image reference for check, vuln, drift, or attest modes | no | — |
| baseline | Baseline image reference for drift-aware modes | no | — |
| fail-on | Severity threshold for vuln/check modes (low|medium|high|critical) | no | — |
| ignore-file | Path to vulnerability ignore file | no | — |
| require-provenance | Whether check mode should require valid provenance | no | true |
| fail-on-drift | Whether drift/check mode should fail on drift | no | true |
| allow-extra | Allow extra layers in drift/check mode | no | false |
| allow-missing | Allow missing layers in drift/check mode | no | false |
| allow-reorder | Allow re-ordered layers in drift/check mode | no | false |
| format | Output format where supported (text|json|csv) | no | text |
| auth-config | Path to registry auth config yaml | no | — |
| images-file | Path to newline-delimited corpus image list | no | — |
| concurrency | Parallelism for corpus mode | no | 4 |
| image-timeout | Per-image timeout for corpus mode | no | 90s |
| output | Optional output file for corpus mode | no | — |
| args | Raw CLI arguments when mode=args | no | — |
| go-version-file | Path to go.mod used to select the Go toolchain | no | go.mod |
Outputs
| name | description |
|---|---|
| command | The provavalidator command that was executed |
| binary-path | Path to the built provavalidator binary |