spazio-genesi/Attest build artifacts
Attest one or more build artifacts with Spazio Genesi's free proof-of-existence service (SHA-256 fingerprint, timestamped, signed) using the sg-attest CLI. The artifact never leaves the runner — only its fingerprint is sent.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| files | One or more artifact paths/globs, whitespace- or newline-separated (e.g. "dist/*.zip" or a literal path). | yes | — |
| api-key | Attestation API key (sg_k_…). Pass this via a GitHub Actions secret (e.g. secrets.SG_API_KEY in the calling workflow), never a literal value. | yes | — |
| title | Declared title bound to the attestation's signature (optional). | no | "" |
| author | Declared author bound to the attestation's signature (optional). | no | "" |
| year | Declared year/version bound to the attestation's signature (optional). | no | "" |
| note | Declared free-text note bound to the attestation's signature (optional). | no | "" |
| download-pdf | Keep the signed certificate PDF on the runner, as <file>.certificato.pdf. The certificate is always minted either way (that is what archives the attestation and anchors it in Bitcoin); this only decides whether the file is also left behind for you to upload as a build artifact. | no | false |
| cli-version | Pinned version of @spazio-genesi/attest-mcp to run the CLI from. Never "latest" — a floating version could change behavior under you between runs. | no | 0.3.1 |
Outputs
| name | description |
|---|---|
| sha256 | SHA-256 fingerprint of the last attested file. |
| certificate-url | Permanent verification URL (/c/<hash>) of the last attested file. |