| files | File(s) to sign, one path per line. Each gets a detached signature written next to it as <file>.minisig; the files themselves are not modified. | yes | — |
| slug | Project/plugin slug, signed into the trusted comment of every signature. | yes | — |
| file-labels | Optional per-file label, one per line, positionally aligned with `files` (blank line = no label for that file). Signed into that file's trusted comment as label:<label> — use to distinguish multiple artifacts signed in the same run (e.g. build variants). Leave empty to omit labels entirely. | no | "" |
| version | Release version, signed into the trusted comment of every signature. | yes | — |
| secret-key | Contents of the minisign secret key file. Pass a repo/org secret. | yes | — |
| secret-key-password | Password for the secret key (pass a separate secret). Leave empty for unencrypted keys. | no | "" |
| public-key | The minisign public key the signatures will be verified against (bare base64 line or full minisign.pub contents). The action fails if its own output does not verify against this key. | yes | — |
| rekor-upload | Record each signature in the Rekor transparency log. | no | true |
| rekor-required | Fail the job if a Rekor upload fails. Default false: Rekor being unreachable warns but does not block the release. | no | false |
| rekor-server | Rekor server URL. | no | https://rekor.sigstore.dev |
| rekor-extra-args | Extra flags appended verbatim to every `rekor-cli upload` call (whitespace-separated) — use for any additional naming or identifier flags Rekor needs. The release slug/version are already recorded in the log via the signature's trusted comment. | no | "" |
| minisign-version | minisign release to download. | no | 0.12 |
| minisign-sha256 | Pinned sha256 of the minisign linux release tarball. | no | 9a599b48ba6eb7b1e80f12f36b94ceca7c00b7a5173c95c3efc88d9822957e73 |
| rekor-cli-version | rekor-cli release to download. | no | v1.5.3 |
| rekor-cli-sha256 | Pinned sha256 of the rekor-cli linux-amd64 binary. | no | c519704f8e665c192dbf190d3ac977068d3e74163951a50b3d34972478e5bbb0 |
| rekor-cli-arm64-sha256 | Pinned sha256 of the rekor-cli linux-arm64 binary. | no | ed512351029db07af8ce34a8bbcbb2938e229681df74cd4ae26fed92682d0faa |