korext/Supply Chain Attestation Check
Scan supply chain AI provenance and enforce policy
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| max-ai-percentage | Maximum weighted AI percentage | no | "" |
| max-high-risk | Maximum high risk dependencies | no | "" |
| min-coverage | Minimum attestation coverage | no | "" |
| block-ungoverned-ai | Fail if any HIGH or FULL AI dep lacks governance | no | false |
| require-attested-for | Glob for deps requiring ATTESTED tier | no | "" |
| ecosystem | Force ecosystem | no | "" |
| sbom-output | Emit SBOM: cyclonedx or spdx | no | "" |
| private-registry | Private registry URL | no | "" |
| private-registry-token | Private registry auth token | no | "" |
Outputs
| name | description |
|---|---|
| weighted-ai-percentage | Calculated weighted AI percentage |
| high-risk-count | Number of high risk dependencies found |
| coverage | Attestation coverage percentage |
| sbom-path | Path to generated SBOM file |
| status | Policy check status |