valkey-io/Verify Provenance
Checks PRs for code provenance against a source repository or refreshes fingerprint databases.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| mode | Operation mode: check or refresh | no | check |
| source_repo | The source repository (e.g., redis/redis) | yes | — |
| target_repo | The target repository (e.g., valkey-io/valkey) | yes | — |
| normalization_pairs | Comma-separated Source:Target normalization pairs (e.g., Redis:Valkey,RM_:VM_) | no | — |
| github_token | GitHub token | yes | — |
| db_branch | Orphan branch for databases | no | verify-provenance-db |
| pr_db_file | Filename of PR database | no | pr_fingerprints.json.gz |
| commit_db_file | Filename of commit database | no | commits_bootstrap.json.gz |
| cutoff_date | Cutoff date for refresh (ISO 8601) | no | 2024-03-20T00:00:00Z |
| threshold | Similarity threshold | no | 0.85 |
| exclude_dirs | Comma-separated target-side directories to ignore during check mode (e.g., deps/) | no | "" |
Outputs
no outputs