GitHub Action
Official action attestd-io/check-action. Pin with @v1. Calls the Attestd API from your workflow without a custom script.
Marketplace: github.com/attestd-io/check-action. Store your key as the repository secret ATTESTD_API_KEY.
Deploy gate and lockfile scan
Deploy gate
Single product + version. Fail the job when risk meets fail_on. Use as a required check before deploy.
Lockfile scan
Path to requirements.txt or package-lock.json (v2/v3). Chunks into batch API calls. Typical PR use: fail_on: never plus the results artifact.
Provide either lockfile or product + version, not both.
Block a deploy on high or critical
name: Deploy
on:
push:
branches: [main]
jobs:
security-check:
runs-on: ubuntu-latest
steps:
- uses: attestd-io/check-action@v1
with:
api_key: ${{ secrets.ATTESTD_API_KEY }}
product: nginx
version: "1.20.0"
fail_on: high
deploy:
needs: security-check
runs-on: ubuntu-latest
steps:
- run: echo "Deploying..."Scan package-lock.json on pull requests
Batches of 100 call POST /v1/check/batch. If a batch would exceed quota, that batch is rejected before billing. Earlier successful batches stay billed.
name: Attestd lockfile scan
on: [pull_request]
jobs:
attestd:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Scan package-lock.json
id: scan
uses: attestd-io/check-action@v1
with:
api_key: ${{ secrets.ATTESTD_API_KEY }}
lockfile: package-lock.json
fail_on: never
- uses: actions/upload-artifact@v4
if: always()
with:
name: attestd-scan
path: ${{ steps.scan.outputs.results_path }}Same pattern for pinned PyPI requirements:
- uses: attestd-io/check-action@v1
with:
api_key: ${{ secrets.ATTESTD_API_KEY }}
lockfile: requirements.txt
fail_on: highInputs
| Input | Description |
|---|---|
api_key | Required. Attestd API key (atst_...). |
product | Single-check slug. Mutually exclusive with lockfile. |
version | Single-check version. Required with product. |
lockfile | Path to requirements.txt or package-lock.json (v2/v3). |
fail_on | critical | high (default) | elevated | any | never. |
fail_on_provenance_missing | If true, fail when provenance is false (default false). |
max_packages | Lockfile safety cap (default 2000). Fails before API calls if exceeded. |
results_file | Lockfile JSON summary path (default attestd-scan-results.json). |
base_url | Override only for local/staging tests. |
Outputs
Single-check outputs: risk_state, actively_exploited, fixed_version, cve_ids, supported, compromised, provenance, typosquat.
Lockfile outputs: packages_scanned, packages_flagged, packages_unsupported, highest_risk_state, results_path.
What fails the step
| Condition | Behavior |
|---|---|
| Unsupported product | Warns. Does not fail (unless typosquat). Not a safety signal. |
| risk_state >= fail_on | Fails the step. Default threshold is high. |
| Supply-chain compromise | Fails unless fail_on is never. |
| Typosquat detected | Fails unless fail_on is never. |
| Quota exceeded (429) mid lockfile scan | Fails. Reports packages already billed vs the rejected batch (rejected before billing). |
| Lockfile exceeds max_packages | Fails before any API call. |
| requirements.txt ranges / VCS / editable | Skipped with a warning. Only == pins are checked. |
| package-lock.json v1 | Fails with a clear upgrade message (v2/v3 required). |