luckypipewrench/Pipelock Agent Egress Control

Run a script through Pipelock, verify receipts, and write an Audit Packet.

Trust Signals

name	description	required	default
script-path	Bash script path to run inside the Pipelock action boundary. Must resolve under working-directory.	yes	—
script-args	Optional newline-delimited script arguments. Each line is passed as one argv element.	no	""
config	Pipelock config path. Caller policy is preserved while action-owned identity, listener, proxy, and receipt settings are forced.	no	.pipelock/ci.yaml
agent-identity	Agent identity stamped into receipts and Audit Packet metadata.	no	github-actions-agent
pipelock-version	Reserved for future pinned installs. This action does not download latest releases; use pipelock-bin or put pipelock on PATH.	no	""
pipelock-bin	Existing pipelock binary path. If empty, pipelock must already be on PATH.	no	""
signer-private-key-path	Existing Pipelock Ed25519 private signing key path. When empty, an ephemeral key is generated outside the agent boundary.	no	""
signer-public-key	Expected signer public key, as raw hex, Pipelock public key text, or a file path. Requires signer-private-key-path.	no	""
audit-packet-dir	Directory where the JSON and Markdown Audit Packet will be written.	no	pipelock-audit-packet
working-directory	Directory where the agent script runs.	no	.
fail-on-verifier-error	Fail the action when receipt verification fails.	no	true
debug	Echo sensitive command details to logs. Default false keeps logs redacted.	no	false

name	description
audit-packet-path	Path to the generated Audit Packet directory.
receipt-count	Number of receipts found in the verified chain.
verifier-verdict	Receipt verifier verdict.