trigguard-ai/TrigGuard Authorization
Authorize execution surfaces with TrigGuard. One-step install; verifies receipt locally.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| surface | Execution surface (e.g. deploy.release, database.migrate) | yes | — |
| gateway_url | Execution gateway base URL (staging or production). Same as endpoint/authorityUrl. | no | — |
| endpoint | Alias for gateway_url (legacy) | no | — |
| authorityUrl | Alias for gateway_url (legacy) | no | — |
| actor_id | Actor identifier (maps to gateway actorId) | no | github-actions |
| actorId | Alias for actor_id (legacy) | no | — |
| workload_identity_provider | GCP WIF provider resource id (projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID). Use with service_account for OIDC (no static secret). | no | — |
| service_account | GCP service account email to impersonate (must have roles/run.invoker on the gateway). Use with workload_identity_provider. | no | — |
| authToken | Legacy static bearer (e.g. TRIGGUARD_CLOUD_TOKEN). Prefer workload_identity_provider + service_account. | no | — |
| repository | GitHub owner/repo (e.g. org/repo). Pass github.repository so policy can allowlist deploy.release per repo. | no | — |
| branch | Branch or ref name (optional). Passed in execution context for policy. | no | — |
| execution_mode | enforce (default) or observe — evaluate policy without blocking the workflow when observe. | no | enforce |
Outputs
| name | description |
|---|---|
| decision | Effective authorization decision (PERMIT when the step succeeds; in observe mode this is always PERMIT) |
| would-decision | Policy evaluation when execution_mode is observe (PERMIT, DENY, or SILENCE) |
| would_decision | Alias for would-decision |
| execution-token | TG-EAT JWT from POST /execute — pass to trigguard-verify-execution-token |
| execution_token | Alias for execution-token |
| execution-id | Execution ID from gateway response or receipt |
| execution_id | Alias for execution-id |
| receipt | JSON-serialized signed TrigGuard receipt |