testifysec/witness-run
Creates Attestation of CI Process with Witness
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| witness-install-dir | Directory to install witness in. The directory will be created if it does not exist | no | — |
| archivista-server | URL of the Archivista server to store or retrieve attestations | no | https://archivista.testifysec.io |
| archivista-headers | Headers to include when making requests to Archivista. Input is expected to be new line separated | no | "" |
| attestations | Attestations to record | no | environment git github |
| attestor-link-export | Export the attestor link predicate in its own attestation | no | false |
| attestor-maven-pom-path | Path to the Maven POM file | no | — |
| attestor-sbom-export | Export the SBOM predicate in its own attestation | no | false |
| attestor-slsa-export | Export the SLSA predicate in its own attestation | no | false |
| enable-sigstore | Use Sigstore for attestation | no | true |
| command | command to run | yes | — |
| certificate | Path to the signing key's certificate | no | — |
| enable-archivista | Use Archivista to store or retrieve attestations | no | true |
| fulcio | Fulcio address to sign with | no | — |
| fulcio-oidc-client-id | OIDC client ID to use for authentication | no | — |
| fulcio-oidc-issuer | OIDC issuer to use for authentication | no | — |
| fulcio-token | Raw token to use for authentication | no | — |
| intermediates | Intermediates that link trust back to a root of trust in the policy | no | — |
| key | Path to the signing key | no | — |
| outfile | File to which to write signed data. Defaults to stdout | no | — |
| product-exclude-glob | Pattern to use when recording products. Files that match this pattern will be excluded as subjects on the attestation. | no | — |
| product-include-glob | Pattern to use when recording products. Files that match this pattern will be included as subjects on the attestation. | no | — |
| spiffe-socket | Path to the SPIFFE Workload API socket | no | — |
| step | Name of the step being run | yes | — |
| timestamp-servers | Timestamp Authority Servers to use when signing envelope | no | — |
| trace | Enable tracing for the command | no | false |
| version | Version of Witness CLI | no | 0.9.2 |
| workingdir | Directory from which commands will run | no | — |
Outputs
no outputs