| app-client-id | GitHub App client ID for authentication | yes | — |
| app-private-key | GitHub App private key (PEM format) | yes | — |
| github-token | GitHub token for GitHub Packages publishing (optional).
Use this when the GitHub App doesn't have packages:write permission.
Typically pass secrets.GITHUB_TOKEN with workflow permissions: packages: write.
| no | "" |
| skip-token-revoke | Skip token revocation in post-action (tokens expire after 1 hour anyway) | no | false |
| release-branch | Release branch name | no | changeset-release/main |
| target-branch | Target branch for PR (usually main) | no | main |
| pr-title-prefix | Prefix for release PR title | no | chore: release |
| dry-run | Run in dry-run mode (preview only, no actual changes) | no | false |
| phase | Explicitly set the workflow phase to run, skipping automatic detection.
Useful when phase was already determined by silk-router-action.
Valid values: branch-management, validation, publishing, close-issues, none
| no | "" |
| npm-token | NPM access token for publishing to npmjs.org (optional).
When to use:
- First-time publish: OIDC requires the package to exist on npmjs.com first
- Packages not configured for OIDC: If trusted publishing isn't set up
- Fallback authentication: When OIDC fails or isn't available
When NOT needed:
- Packages configured with npm OIDC trusted publishing
- The package already exists and trusts your GitHub repository
Token types supported:
- Granular access tokens (recommended, 90-day max expiry)
- Automation tokens (for CI/CD, bypasses 2FA)
Create at: https://www.npmjs.com/settings/tokens
| no | "" |
| strict-warnings | When 'true', warning-severity validation findings escalate the per-step
and unified check-run conclusions from 'neutral' to 'failure', blocking
branch-protection-gated auto-merge. Errors always fail regardless.
Default 'false' preserves the existing semantics: warnings are advisory
(check-run conclusion 'neutral'), errors block.
Useful for automated release pipelines (e.g., daily runtime-resolver
runs) where an LLM or auto-merge bot gates on check status — a strict
warning means human intervention is required before merge.
| no | false |
| sbom-config | SBOM metadata configuration (JSON). Provides supplier, copyright, and other
metadata for NTIA-compliant SBOM generation.
Format: JSON with an "sbom" key containing the metadata:
{
"sbom": {
"supplier": {
"name": "Your Company",
"url": "https://company.com",
"contact": { "email": "security@company.com" }
},
"copyright": { "holder": "Your Company LLC" }
}
}
Can also be passed via SILK_RELEASE_SBOM_TEMPLATE environment variable.
Input takes precedence over environment variable.
| no | "" |
| custom-registries | Custom registries with authentication (one per line).
Format (one registry per line):
https://registry.example.com/_authToken=<token>
https://registry.example.com/_auth=<base64-credentials>
https://registry.example.com/ # Falls back to GitHub App token
For reusable workflows, store the entire config in a secret:
1. Create a repository secret (e.g., CUSTOM_REGISTRIES) containing:
https://registry.example.com/_authToken=npm_abc123
https://other-registry.com/_authToken=npm_xyz789
2. Pass it to the action:
custom-registries: $\{{ secrets.CUSTOM_REGISTRIES }}
Note: For npm, use the npm-token input instead of custom-registries
Note: JSR uses OIDC trusted publishing (no configuration needed)
Note: GitHub Packages authenticates automatically with the GitHub App token
| no | "" |