Repository navigation
attest: timestamp inputs for key-based signing, and input documentation fixes - #133
Merged
Merged
Conversation
The timestamp and transparency-log inputs are forwarded to the CLI only when `keyless: true`, and the CLI applies them only in keyless mode, but the README inputs table and the action.yml descriptions presented them as generally applicable. The air-gapped section recommends `sign-key` immediately above that table, so the combination read as supported. - Mark tlog-upload, include-timestamp, fulcio-server-url, rekor-server-url, timestamp-server-url and allow-submit-data-to-public-sigstore as keyless-only in both the README table and the action.yml input descriptions. - Add the previously undocumented include-timestamp input to the table. - Note in the air-gapped section that signatures produced with sign-key or a KMS provider carry no timestamp. - Correct the KMS bullet: Vault transit is the only implemented backend, so drop the awskms example. Documentation only. action.yml is read directly by the Actions runtime, so no dist rebuild is required. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
The README table already lists allow-submit-data-to-public-sigstore as keyless-only, but its action.yml description, which the Actions UI shows, did not say it is ignored otherwise. index.js forwards it only in the keyless branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
include-timestamp and timestamp-server-url were forwarded to the CLI only with keyless: true, so workflows signing with sign-key could not request an RFC 3161 timestamp. Forward them for sign-key when include-timestamp is true. With include-timestamp false or unset the CLI arguments are unchanged, and keyless forwarding is unchanged. Older cimon releases accept these flags with --key and produce no timestamp, so the action can ship ahead of the CLI release. README and action.yml describe the behavior, with a key-based timestamping example. dist/ rebuilt. Closes #132 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ronens88
force-pushed
the
feat/keyed-timestamp-inputs
branch
from
October 6, 2026 09:08
141e5b2 to
8e8bbf2
Compare
ronens88
changed the title
RoniMuchacho
approved these changes
Oct 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #132. Includes the changes from #128.
Timestamp inputs for key-based signing
include-timestampandtimestamp-server-urlare now forwarded to the CLI withsign-keywheninclude-timestamp: true.include-timestampfalse or unset, the CLI arguments are identical to today.--keyand produce no timestamp, so this can ship ahead of the CLI release.Input documentation
tlog-upload,fulcio-server-url,rekor-server-url,allow-submit-data-to-public-sigstore) are marked keyless-only in the README and in theaction.ymldescriptions shown in the Actions UI.include-timestampis added to the README inputs table; it was previously undocumented.fail-on-error: true, because by default a failed attestation is only logged as a warning.dist/is rebuilt; the bundle diff is the new branch only.Verification
Ran the rebuilt
dist/index.jswithrelease-pathpointing at a stub binary that records its arguments:sign-key,include-timestamp: true, URL--key private-key.pem --include-timestamp=true --timestamp-server-url=http://timestamp.sectigo.comsign-key,include-timestamp: false, URL--key private-key.pemsign-key,include-timestamp: true, no URL--key private-key.pem --include-timestamp=truekeyless: true--keyless --tlog-upload=true --include-timestamp=false --yes=false --timestamp-server-url=...(unchanged)🤖 Generated with Claude Code