wildmason/GHA GitHub Service Proof

Check GitHub Actions service/API compatibility with offline receipts: REST permissions, gh CLI, OIDC, and gh-log replay.

Trust Signals

name	description	required	default
version	Crate version to install, or latest.	no	latest
command	Command to run. Use check-workflow, permissions, call, oidc, or gh-log.	no	check-workflow
repo	Repository root for check-workflow.	no	.
workflow	Newline-separated workflow paths for check-workflow, or single workflow path for permissions.	no	—
job	Job id for permissions mode.	no	—
method	HTTP method for call mode.	no	—
path	Request path for call mode.	no	—
url	Original URL for call mode (optional).	no	—
origin	Origin label for call mode (optional).	no	—
permissions	Inline JSON permissions object or shorthand (read-all / write-all).	no	—
permissions-file	Path to a JSON file with the permissions block.	no	—
audience	OIDC audience for oidc mode.	no	—
repository	owner/repo for oidc mode.	no	—
ref	Git ref for oidc mode.	no	—
sha	Commit SHA for oidc mode.	no	—
workflow-name	Workflow file name for oidc mode (e.g. release.yml).	no	—
oidc-job	Job id for oidc mode.	no	—
run-id	Run id for oidc mode.	no	—
job-workflow-ref	Optional job_workflow_ref claim for oidc mode.	no	—
ttl-seconds	OIDC token TTL in seconds.	no	—
claim	Newline-separated NAME=JSON extra claims for oidc mode.	no	—
log	Path to a canonical gh-log JSON bundle for gh-log mode.	no	—
unsafe-full-payloads	Disable redaction-by-schema-contract for gh-log mode. Use only for local debugging.	no	false
format	Receipt format: text, json, or markdown.	no	text
output	Optional receipt output path.	no	—
strict	Treat warnings as failures.	no	false

no outputs