netriseinc/Provenance Supply Chain Check
Download the provenance CLI and run a supply chain check against an SBOM or package.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| sbom | Path to the SBOM file to check | no | "" |
| package | Package URL (PURL) to check (alternative to sbom) | no | "" |
| policy | Path to policy file or directory | no | "" |
| format | Output format: human, json, sarif | no | human |
| api-token | Provenance API token (use secrets.PROVENANCE_API_TOKEN) | yes | — |
| version | CLI version to download (e.g., v0.1.0). Defaults to latest. | no | latest |
| quiet | Show only summary output | no | false |
Outputs
| name | description |
|---|---|
| exit-code | Exit code from provenance check (0=pass, 1=deny, 2=review, 3=error) |
| sarif-file | Path to SARIF output file (when format=sarif) |
| json-file | Path to JSON output file (when format=json) |