trustbeat/TrustBeat Anchor — qualified EU timestamps
eIDAS-qualified timestamps for your CI artifacts — court-grade legal proof of when for NIS2/DORA, in one YAML block.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| api-key | TrustBeat API key (tb_live_…). Store it as a repository secret. Free tier: 100 anchors/month, no card — https://trustbeat.eu/register | yes | — |
| files | Files to anchor — one glob or path per line (e.g. dist/*.tar.gz). Each file's SHA-256 is computed locally; file contents never leave the runner. | yes | — |
| description | Human-readable label stored with each anchor. Defaults to "<repo>@<ref>". | no | "" |
| client-ref | Your correlation reference stored with each anchor. Defaults to the commit SHA. | no | "" |
| wait | "true" to block until the inclusion proof is issued (next ~10-minute batch). Default "false": submit and finish fast — the proof and badge links go live automatically when the batch fires. | no | false |
| api-url | TrustBeat API base URL. | no | https://api.trustbeat.eu |
Outputs
| name | description |
|---|---|
| results | JSON array of {file, hash, id, verify_url, badge_url} — one entry per anchored file. |
| ids | JSON array of tracking IDs. |