sns45/Assayward Supply-Chain Verify
Verify container image supply-chain evidence against a trust policy using assayward.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| image | Container image reference in name@sha256:<hex> format (required). | yes | — |
| policy | Built-in policy name: baseline | slsa-l3 | serverless-edge. Used when policy-file is not set. | no | slsa-l3 |
| policy-file | Path to a TrustPolicy YAML file. When set, overrides the policy input. | no | "" |
| bundle | Attestation bundle file paths, one per line (multiline). Each non-empty line becomes a --bundle argument. | no | "" |
| from-oci | Set to 'true' to discover attestations via the OCI referrers API for the given image. | no | false |
| sigstore-trust-root | Path to a Sigstore trusted-root JSON file. | no | "" |
| spiffe-bundle | SPIFFE trust-domain bundle entries, one per line, in trustDomain=path format. | no | "" |
| svid | Path to a SVID credential (JWT token or PEM X.509). | no | "" |
| version | assayward release version to download (e.g. v0.1.0) or 'latest'. | no | latest |
| forgeseal-output | Path to a forgeseal output directory; assembles attestations from forgeseal's native SBOM/SLSA/VEX files | no | "" |
| signature-ca | Path to a CA cert (PEM) used to verify forgeseal's keyed-CA Sigstore bundle signature | no | "" |
| binary-path | Path to a pre-built assayward binary. When set, skips the download step. Useful for testing or bring-your-own-binary scenarios. | no | "" |
Outputs
| name | description |
|---|---|
| result | The verification result: allow, deny, or audit. |
| decision | The full decision JSON emitted by assayward verify. |