Repository navigation
Conversation
The timestamp and transparency-log inputs are forwarded to the CLI only when `keyless: true`, and the CLI applies them only in keyless mode, but the README inputs table and the action.yml descriptions presented them as generally applicable. The air-gapped section recommends `sign-key` immediately above that table, so the combination read as supported. - Mark tlog-upload, include-timestamp, fulcio-server-url, rekor-server-url, timestamp-server-url and allow-submit-data-to-public-sigstore as keyless-only in both the README table and the action.yml input descriptions. - Add the previously undocumented include-timestamp input to the table. - Note in the air-gapped section that signatures produced with sign-key or a KMS provider carry no timestamp. - Correct the KMS bullet: Vault transit is the only implemented backend, so drop the awskms example. Documentation only. action.yml is read directly by the Actions runtime, so no dist rebuild is required. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: de81119088
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The README table already lists allow-submit-data-to-public-sigstore as keyless-only, but its action.yml description, which the Actions UI shows, did not say it is ignored otherwise. index.js forwards it only in the keyless branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Consolidated into #133, which includes these commits. |
Documentation only. Companion to CycodeLabs/cycodelabs.github.io#123.
Keyless-only inputs
include-timestampandtimestamp-server-urlare forwarded to the CLI only inside thekeylessbranch, and the CLI itself applies timestamping only in keyless mode. The README inputs table and theaction.ymldescriptions presented these as generally applicable, and the air-gapped section recommendingsign-keysits immediately above that table, so the combination read as supported.tlog-upload,include-timestamp,fulcio-server-url,rekor-server-url,timestamp-server-urlandallow-submit-data-to-public-sigstoreas keyless-only in the README table and theaction.ymlinput descriptions, which render in the Actions UI.include-timestampto the README table; it was previously undocumented.sign-keyor a KMS provider carries no timestamp, and that RFC 3161 timestamping for keyed signing is a known gap.KMS backends
HashiCorp Vault transit is the only implemented
--kmsprovider, so theawskms://<arn>example in the air-gapped section has been removed.Notes
No behavior change, and no
distrebuild:action.ymlis read directly by the Actions runtime andindex.jsis untouched.One inconsistency is documented as-is rather than changed, since altering it would be a behavior change:
include-timestampdefaults tofalseinaction.ymlwhile the CLI flag defaults totrue.🤖 Generated with Claude Code