GitHub Actions

Add one workflow step after your image is built to record a build Evidence Event (with digest). The action emits through the Evidence SDK, same as the other exporters.

Repository: Evitrus/action

Setup

1. Store your tenant API key as a repository or organisation secret, e.g. EVITRUS_KEY.
2. Add a step after build/push:

- uses: evitrus/action@v1
  with:
    api-key: ${{ secrets.EVITRUS_KEY }}
    service: payments-api
    type: build.artifact.published
    image: ghcr.io/acme/payments-api@${{ steps.build.outputs.digest }}

commit defaults to GITHUB_SHA. Actor, repository, workflow, ref, and run URL are attached automatically.

Inputs

Input	Required	Default	Notes
api-key	yes	—	Tenant ingest key (evt_…)
service	yes	—	Logical service name
type	no	build.succeeded	Prefer catalog types (build.artifact.published, test.scan.completed, deploy.succeeded). Legacy names (build.succeeded, security.scan) still ingest.
ingest-url	no	https://api.evitrus.dev/ingest	Override for other environments
image	no	—	Image ref; @sha256:… digest is parsed
digest	no	—	Explicit digest (overrides parsed)
environment	no	—	For deploy.* events
commit	no	GITHUB_SHA	Source commit
summary	no	auto	Human-readable summary
tags	no	—	Extra tags, e.g. team:payments,tier:1
metadata	no	—	Extra JSON object string
fail-on-error	no	true	Fail the job if recording fails

The action polls GET {ingest-url}/config and skips emit when a tenant ignore rule matches. Ingest 422 {ignored:true} is also treated as a successful skip.

Example release job

See examples/release.yml in the action repository.

This step only records facts. To gate a ship, add a second step with mode: check — see GitHub Actions evaluator.

Correlate with Kubernetes

Emit the same commit (and ideally the same image digest) from CI and from the Kubernetes exporter. Evitrus groups them into one Change for Changelog and the evidence Audit log.