linus10x/finserv-agent-audit
Verify a finserv-agent-audit JSONL audit chain in CI. Hash-chain integrity, coverage threshold, optional witness-anchor enforcement, optional MI Proxy verifier attestation.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- None
Pinned Snippet
uses: linus10x/finserv-agent-audit@be7cc4be0c4de95e21efe7da90d81c8953dd846e # v2.2.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| audit-jsonl-path | Path to the JSONL audit-chain file to verify. | yes | — |
| min-coverage | Minimum branch-coverage percentage required (informational, surfaced in the step summary). The default mirrors the package CI gate. | no | 90 |
| expect-witness-anchor | If "true", fail the action when no WITNESS_ANCHOR entries are found in the last N events of the chain. Use this on repos that mandate external witness anchoring (Rekor / OpenTimestamps) per ADR-0014. | no | false |
| witness-anchor-window | Window size (in events) for the witness-anchor check. | no | 100 |
| mi-proxy-key | Optional HMAC signing key for the MI Proxy verifier attestation (ADR-0015). When set, the verify step runs verify_strict with the proxy wired. Treat this as a SECRET — pass via secrets.X. CR-9: the value is injected as the FINSERV_AUDIT_MI_PROXY_KEY environment variable on the verify step and is never placed on the CLI argv (would leak via `ps`, /proc/$pid/cmdline, container labels, CI step-summaries, or shell history). | no | "" |
| python-version | Python version to use for verification. | no | 3.12 |
Outputs
no outputs