Skip to content

art50-ci v0.3.0 — zero-setup GitHub Action

Marketplace
Marketplace

Choose a tag to compare

View all tags
@Rubiss Rubiss released this 24 Jul 10:39
· 46 commits to main since this release
v0.3.0
ba5a2b0

Zero-setup GitHub Action

Practical guides:

Use art50-ci in a GitHub-hosted Linux job without adding it to the caller's package manifest:

- uses: actions/checkout@v6
- uses: Rubiss/art50-ci@v0.3.0
  with:
    config: .art50-ci.yml

The composite action installs its runtime under GITHUB_ACTION_PATH and installs Chromium by default. For a completed audit, it uploads the validated JSON/HTML/screenshot/provenance report directory before propagating exit code 0 or 1. Configuration or execution errors return 2; an error before report creation may produce no artifact.

Inspect the public released-version C2PA pass and stripped-delivery proof.

Release safeguards

  • JavaScript dependencies are installed from the tagged lockfile with lifecycle scripts disabled.
  • The platform-specific C2PA native archive is verified against a release-pinned SHA-256 digest before extraction.
  • Nested setup and artifact actions are pinned to full commit SHAs.
  • The report output must be a new or empty repository-relative directory; escaping symlinks and generated symlinks are rejected.
  • CI proves pass and intentional-failure behavior in an isolated non-Node consumer workspace, including evidence retention before exit 1.

Report and provenance schemas remain version 2. Configuration remains version 1; no configuration migration is required. The action currently supports GitHub-hosted Linux runners.

Local install

npm install --save-dev art50-ci@0.3.0
npx playwright install chromium

The npm package, GitHub release tarball, and tagged Action are all available. For a release-asset install instead:

npm install --save-dev https://github.com/Rubiss/art50-ci/releases/download/v0.3.0/art50-ci-0.3.0.tgz

Release-asset SHA-256: 3d6fbe0c392becc3512d44183b06877e2ad19d4d274ddeb0bce3d4d3a468fda1

Assets 3
Loading