Skip to content

README.md

Latest commit

 

History

History
76 lines (57 loc) · 3.27 KB

README.md

File metadata and controls

76 lines (57 loc) · 3.27 KB
Raw

Burling AIP Conformance Action

Run burling — the conformance validator and IBCT chain auditor for the Agent Identity Protocol (draft-prakash-aip-00) — in CI, and surface findings as SARIF in GitHub code scanning.

The action is a thin Docker wrapper over burling lint --format sarif. It produces a SARIF document and exposes its path as an output; pair it with github/codeql-action/upload-sarif to get inline annotations on pull requests and alerts in the Security tab.

Usage

name: AIP conformance
on: [pull_request]

permissions:
  contents: read
  security-events: write   # required by upload-sarif

jobs:
  burling:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - id: burling
        uses: goweft/burling-action@v0
        with:
          token: path/to/token.jwt

      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.burling.outputs.sarif-file }}

By default the action does not fail the step on findings — it writes the SARIF and lets code scanning surface the alerts, so the upload-sarif step always runs. To gate the build directly instead, set fail-on-error: true.

Inputs

Input Required Default Description
token yes — Path to the artifact to validate, relative to the repository root.
command no lint burling subcommand: lint, validate, validate-identity, or audit-chain.
strict no false Promote WARNING findings to failures (passes --strict).
fail-on-error no false Fail this step on an ERROR finding. Leave false so a later upload-sarif step still runs.
output no burling.sarif Path to write the SARIF document, relative to the repository root.

Outputs

Output Description
sarif-file Path to the generated SARIF file, for upload-sarif's sarif_file.

What burling checks

burling validates identity documents and compact (JWT/EdDSA) IBCTs against the mechanically-checkable normative requirements of the AIP draft. Chained mode and scope attenuation are stubbed in the current release and emit informational findings. See the burling conformance matrix for the full list of checks and their severities.

Versioning

Releases are tagged with semver (v0.1.0) plus a moving major alias (v0). Pin the major alias for automatic compatible updates, or pin an exact tag for full reproducibility. The image builds a pinned burling release, so a given action tag always runs a known validator version.

License

Apache License 2.0. See LICENSE.