redbullhorns/JWTShield CI

CI auth regression tests + JWKS rotation drift detection. Five lines.

Trust Signals

name	description	required	default
api-key	jwtshield API key. Get one at https://jwtshield.com/signup. Recommended: store as a GitHub Actions secret and reference as ${{ secrets.JWTSHIELD_API_KEY }}.	yes	—
issuer	Expected token issuer URL (e.g. https://login.example.com). Tokens with a different `iss` claim fail validation.	yes	—
audience	Expected audience claim (e.g. api://backend). Tokens with a different `aud` claim fail validation.	yes	—
allowed-algs	Comma-separated allowed signature algorithms (e.g. "RS256,ES256"). Defaults to RS256 only. NEVER include `none`.	no	RS256
fail-on-severity	Severity threshold. One of: low, medium, high, critical. Findings at or above this severity fail the build.	no	high
fail-mode	How to behave when jwtshield.com is unreachable. `hard` (default): fail the CI step on jwtshield outage. `soft`: warn-only, exit 0, do not block the build.	no	hard
endpoint	jwtshield API base URL. Override only for staging/self-host.	no	https://api.jwtshield.com
cache-ttl-seconds	How long to cache the last successful response (used during outages in soft mode). Default 300 (5 minutes).	no	300
token	Optional: a real or synthetic JWT to validate against the policy above. If omitted, the action validates issuer config only (lint mode). Recommended: use synthetic tokens generated by your test fixtures, never production tokens.	no	""

name	description
status	Overall result. One of: pass, fail, warn, degraded.
findings-count	Number of findings emitted at any severity.
evidence-url	Public URL of the audit trail entry. Empty when degraded/cached.