nolabs-ai/agent-sign

Sign AI agent files or publish nono packages with Sigstore and Nono keyless attestation

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
nono-version	nono CLI version to install (e.g. v0.6.1). Defaults to latest release.	no	latest
package-version	Registry package version to publish. Required when publish is true.	no	""
files	Whitespace-separated list of files to sign. If empty, uses --all to sign all files matching trust policy includes. When multiple files are specified, they are signed together into a single multi-subject bundle (.nono-trust.bundle) for atomic verification.	no	""
per-file	Sign each file separately with its own sidecar bundle (<file>.bundle) instead of combining into a single multi-subject bundle. Default is false (multi-subject).	no	false
commit	Commit bundle files back to the repository.	no	true
upload-artifacts	Upload bundle files as workflow artifacts.	no	false
verify	Run verification after signing as a smoke test.	no	true
trust-policy	Path to trust-policy.json for verification. Only used when verify is true.	no	""
working-directory	Working directory for signing. Defaults to repository root.	no	.
commit-message	Commit message for bundle commits.	no	chore: update attestation bundles [skip ci]
publish	Publish a nono package version to the registry after signing.	no	false
package-name	Registry package name. Required when publish is true.	no	""
package-namespace	Registry namespace or organization. Optional: defaults to the owner of GITHUB_REPOSITORY.	no	""
registry-url	Registry API base URL. Used when publish is true.	no	https://registry.nono.sh/api/v1
package-path	Package directory containing package.json and artifacts. Used when publish is true.	no	.

Outputs

no outputs