Secure drop-in replacement for slsa-framework/slsa-github-generator, maintained by StepSecurity.
| Action | Description |
|---|---|
| compute-sha256 | Computes the SHA256 digest of a file |
| create-container_based-predicate | Creates a container-based SLSA predicate |
| detect-workflow-js | Detects the calling workflow using OIDC or context |
| generate-attestations | Generates and uploads SLSA attestations |
| generate-builder | Builds or fetches the builder binary |
| privacy-check | Checks repository visibility before publishing to transparency log |
| rng | Generates a random value |
| secure-builder-checkout | Checks out the builder repository at a pinned ref |
| secure-download-artifact | Downloads and verifies an artifact by SHA256 |
| secure-download-folder | Downloads and verifies a folder artifact by SHA256 |
| secure-project-checkout | Checks out the user project at a verified ref |
| secure-project-checkout-go | Checks out and sets up a Go project |
| secure-project-checkout-node | Checks out and sets up a Node.js project |
| secure-upload-artifact | Uploads an artifact and outputs its SHA256 |
| secure-upload-folder | Uploads a folder as a tarball and outputs its SHA256 |
| sign-attestations | Signs SLSA attestations using Sigstore |
| tscommon | Shared TypeScript library used by the Node.js actions |
| verify-token | Verifies the SLSA token passed from the reusable workflow |