relizaio/Rearm submit metadata
Submit Release metadata for a release on Rearm
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Maintainedlast commit Dec 14, 2025
- License
- None
Pinned Snippet
uses: relizaio/rearm-add-release@d40cd001b969b385e0f5ad34e0f770d93df3a179 # 1.5.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| rearm_api_id | Rearm Hub API ID | yes | — |
| rearm_api_key | Rearm Hub API KEY | yes | — |
| image_full_name | Full name of the Docker image with registry prefix | yes | — |
| image_digest | SHA 256 digest of the image artifact | yes | — |
| rearm_build_start | Build start time | yes | — |
| rearm_short_version | Docker and filesystem safe version from Rearm for this release | yes | — |
| rearm_full_version | Version obtained from Rearm for this release | yes | — |
| rearm_build_status | Build status - [complete | rejected] | yes | — |
| rearm_api_url | Rearm Hub API URL | no | https://demo.rearmhq.com |
| deliverable_type | Type of artifact created by this release [CONTAINER, FILE] | no | CONTAINER |
| commit_list | List of commits | no | — |
| rearm_component_id | Component UUID for this release if org-wide key is used | no | — |
| enable_sbom | Generates SBOM and stores it along with the artifact | no | false |
| source_code_sbom_type | Generates SBOM based on source code analysis, possible values: npm, helm, custom, other, none. Use 'custom' to follow Dockerfile.sbom with expected output in /sbom/sbom.json | no | none |
| registry_username | Username for image registry | no | — |
| registry_password | Password for image registry | no | — |
| registry_host | Host for image registry | no | — |
| finalize_release | Finalize the release after adding it (true/false) | no | true |
| path | Path to the relative to root of the repo (default is '.') | no | . |
| send_sce_data | Sends Source Code entry data along with the release, required for SCE SBOMs | no | true |
| last_commit | Last registered commit | no | — |
| enable_public_cosign_sigstore | Sign deliverables and SBOMs using public sigstore via cosign | no | false |
| enable_codeql | Enable CodeQL analysis | no | false |
| codeql_language | Language to analyze with CodeQL, use 'custom' to follow Dockerfile.sarif with expected output in /sarif/results.sarif | no | none |
| enable_securesbom | Enable SecureSBOM signing of SBOMs by ShiftLeftCyber | no | false |
| securesbom_pub_key_id | Public key id to sign with SecureSBOM by ShiftLeftCyber | no | — |
| securesbom_host | SecureSBOM (by ShiftLeftCyber) host | no | — |
| securesbom_api_key | SecureSBOM (by ShiftLeftCyber) API key | no | — |
Outputs
no outputs