lfreleng-actions/🏷️ Unified Tag Validation

Validates tags for versioning compliance (SemVer/CalVer) and cryptographic signatures (SSH/GPG)

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 10, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: lfreleng-actions/tag-validate-action@bc8043ec074495cc8cdf351623ebab3675d563cf # v1.0.4

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
tag_location	Path to tag - supports two formats: 1. Remote: ORG/REPO/TAG (e.g., lfreleng-actions/tag-validate-action/v0.1.0) 2. Local: PATH/TO/REPO/TAG (e.g., ./my-repo/v1.0.0) Local paths must contain a .git directory	no	""
tag_string	Tag string to validate (version format only, no signature check)	no	""
require_type	Required tag type: semver, calver, both, none (comma-separated for multiple). When omitted or set to 'none', any format is accepted (including customtags). Examples: 'semver', 'semver,calver', 'none'.	no	""
require_signed	Signature requirement (comma-separated for multiple, e.g., 'gpg,ssh'): - gpg: Require verified GPG signature - ssh: Require verified SSH signature - gpg-unverifiable: Accept GPG signature without verification - unsigned: Must be unsigned Omit for no signature requirement.	no	""
require_github	Requires that the signing key is registered to a GitHub account. Requires a GitHub token.	no	false
require_gerrit	Requires that the signing key is registered to a Gerrit account. Set to 'true' to auto-detect Gerrit server from GitHub org (pattern: gerrit.[org].org), or provide a specific Gerrit server hostname/URL (e.g., 'gerrit.onap.org').	no	false
require_owner	GitHub username(s) or email address(es) that must own the signing key (comma or space-separated for multiple, e.g., 'octocat,monalisa' or 'user@example.com'). Requires a GitHub token. When specified, require_github is implied.	no	""
gerrit_username	Gerrit username for HTTP authentication. Required for Gerrit servers that restrict public access to user key information. Can also be set via GERRIT_USERNAME environment variable. WARNING: Do NOT store this as a GitHub secret. GitHub Actions masks secret values in all outputs, which will cause the username to appear as '***' in the step summary if it matches the key owner's username. Only the password is sensitive.	no	""
gerrit_password	Gerrit HTTP password for authentication. This must be an HTTP password generated from your Gerrit account settings (Settings > HTTP Credentials), NOT your SSO/LDAP password. Required when gerrit_username is provided. Can also be set via GERRIT_PASSWORD environment variable.	no	""
reject_development	Reject development/pre-release tags (tags containing alpha, beta, rc, dev, pre, snapshot, nightly, canary, or preview). When enabled, validation will fail for any tag identified as a development version.	no	false
enforce_increment	Require the tag to be strictly greater than the highest existing comparable tag in the repository (SemVer/CalVer aware). Prevents accidental re-release of older versions, e.g. stale tags pushed from out-of-sync forks. Requires a repository context (tag_location or tag push event); not supported with tag_string.	no	false
require_branch	Require the tag to point to a commit reachable from the given branch. Provide a branch name (e.g. 'main'), or 'true' to auto-detect the repository default branch. Empty, 'false', 'no', or '0' disable the check. Requires a repository context (tag_location or tag push event); not supported with tag_string.	no	""
require_recent	Require the tag to have been created recently. Provide 'true' for the default 3-minute window, or a number of minutes. Uses the tag object's creation timestamp, so an annotated (or signed) tag is required; lightweight tags fail this check. Empty, 'false', 'no', or '0' disable the check. Requires a repository context; not supported with tag_string.	no	false
require_latest	Require the tag to point to the current tip commit of the target branch (require_branch when it names a branch, otherwise the repository default branch). Prevents releases from older commits. Requires a repository context; not supported with tag_string.	no	false
permit_missing	Allow missing tags without error	no	false
token	GitHub token for authenticated API calls and private repository access	no	""
github_server_url	GitHub server URL for git operations (supports GitHub Enterprise Server). If not provided, falls back to GITHUB_SERVER_URL environment variable or https://github.com	no	""
debug	Enable debug output in action logs. This enables both bash command tracing (set -x) and Python verbose logging (--verbose flag), providing comprehensive debugging information including git operations, API calls, and internal validation steps.	no	false
use_local_action	Use local repository action/code instead of the PyPI package. Set to 'true' when testing changes in a fork or branch before merging.	no	false
upload_json	Upload validation results as JSON artifact to the workflow run. The artifact includes detailed validation information in JSON format.	no	true
json_upload_format	JSON artifact format: 'compact', 'pretty', or 'both'. Compact format is single-line, pretty format is indented for readability.	no	pretty
github_step_summary	Write validation summary to GitHub Actions step summary. Automatically detects GitHub Actions environment.	no	true

Outputs

name	description
valid	Set true if tag passes validation checks
tag_type	Detected tag type (semver\|calver\|both\|other\|unknown)
signing_type	Detected signing type (gpg\|ssh\|unsigned\|lightweight\|invalid\|gpg-unverifiable)
development_tag	Set true if development/pre-release tag detected
version_prefix	Set true if tag has version prefix (v or V)
tag_name	The tag name being validated
incremental	Set true if the tag is strictly greater than the highest existing tag in the repository (empty when increment check not performed)
latest_tag	Highest existing comparable tag found in the repository during the increment check (empty when increment check not performed)
recent	Set true if the tag was created within the require_recent window (empty when the tag age check not performed)
latest	Set true if the tag points to the current tip of the target branch (empty when the latest-commit check not performed)
artifact_path	Path to the JSON artifact file (if uploaded)
artifact_suffix	Unique suffix for artifact naming (to avoid conflicts)