Usage
Add the following steps to your GitHub workflow:@main, installs the latest stable release.
Verification
The action downloads the release archive from GitHub releases, checks its SHA256 sum against the release checksums file, and verifies the build provenance attestation published by the Timoni release workflow usinggh attestation verify.
Verification requires the gh CLI and Timoni v0.30.0 or newer.
On runners without gh or network access to GitHub and Sigstore, set the verify input to false.
To verify a release archive outside of GitHub Actions, see the
SLSA provenance section of the installation guide.
Inputs
Outputs
Example of using the output:
Examples
- Module distribution with GitHub Actions: vet, push and sign module versions from GitHub workflows.
- Bundle updates: open pull requests with the module version updates on a schedule.