sns45/forgeseal
Supply chain security for JS/TS, Python, Go, Rust, and Java: SBOM generation, Sigstore signing, SLSA provenance, VEX triage
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| command | Command to run: pipeline, sbom, sign, attest, vex | no | pipeline |
| dir | Project directory | no | . |
| output-dir | Output directory for artifacts | no | ./forgeseal-output |
| lockfile | Explicit path to lockfile (auto-detected if omitted) | no | — |
| sign | Sign artifacts with Sigstore keyless signing | no | true |
| attest | Generate SLSA v1 provenance attestation | no | true |
| vex-triage | Run VEX vulnerability triage against OSV.dev | no | true |
| fail-on | Fail if vulnerabilities at or above this severity: critical, high, medium, low | no | — |
| include-dev | Include devDependencies in SBOM | no | false |
| upload-assets | Upload artifacts to the GitHub Release (requires release context) | no | false |
| version | forgeseal version to install (e.g. 0.1.0). Defaults to latest release. | no | latest |
Outputs
| name | description |
|---|---|
| sbom-path | Path to the generated CycloneDX SBOM |
| bundle-path | Path to the Sigstore signature bundle |
| attestation-path | Path to the SLSA provenance attestation |
| vex-path | Path to the VEX document |
| vuln-count | Number of vulnerabilities found by VEX triage |