GitHub Actions exporter

One workflow step after the image is built records a build Evidence Event, including the digest. The action uses the same Evidence SDK as the other exporters.

Repository: Evitrus/action. Consume it as Evitrus/actions/export@v1. evitrus/action@v1 is a compatibility alias.

Requirements

• A tenant API key with the ingest scope (evt_live_…), stored as a repository or organisation secret
• A workflow that can name the service and, for container builds, the image digest

Install guide

Add a step after build and push. Set ingest-url to the managed API:

- uses: Evitrus/actions/export@v1
  with:
    api-key: ${{ secrets.EVITRUS_KEY }}
    ingest-url: https://api.evitrus.io/ingest
    service: payments-api
    type: build.artifact.published
    image: ghcr.io/acme/payments-api@${{ steps.build.outputs.digest }}

commit defaults to GITHUB_SHA. Actor, repository, workflow, ref, and run URL are attached automatically.

Input	Required	Default	Notes
api-key	yes	—	Tenant ingest key (evt_…)
service	yes	—	Logical service name
type	no	build.succeeded	Prefer catalog types such as build.artifact.published
ingest-url	no	action default	Set https://api.evitrus.io/ingest for the managed cloud
image	no	—	Image ref. A @sha256:… digest is parsed
digest	no	—	Explicit digest. Overrides the parsed one
environment	no	—	For deploy.* events
commit	no	GITHUB_SHA	Source commit
summary	no	auto	Human-readable summary
tags	no	—	Extra tags, e.g. team:payments,tier:1
metadata	no	—	Extra JSON object string
fail-on-error	no	true	Fail the job if recording fails

A full job is in export/examples/release.yml.

The action polls GET {ingest-url}/config and skips the emit when a tenant ignore rule matches. Ingest 422 {"ignored":true} is also a successful skip.

This step only records facts. To gate a ship, add a second step with mode: check. See the GitHub Actions evaluator.

What it emits

The event type is the type input. build.artifact.published is the usual choice after an image push. build.succeeded still ingests and is the action default when type is omitted.

The image digest on artifacts[] is the join to a later Kubernetes deploy.succeeded. Emit the same commit (and the same digest) from CI and from the cluster exporter so they land on one Change.