stamped-github-actions

GitHub composite action for Stamped — create a legally qualified, eIDAS-compliant delivery proof for your repository in one step.

What it does

1. Archives your repository with git archive
2. Encrypts the archive with AES-256-GCM using your key (never transmitted to Stamped)
3. Calls POST /v1/registries/:id/releases to initialize a release and receive a presigned S3 upload URL
4. Uploads the encrypted payload directly to S3 (server not in the data path)
5. Calls POST /v1/registries/:id/releases/:id/finalize to verify the checksum, acquire an RFC 3161 eIDAS timestamp from Evidency, and seal the release in Object Lock COMPLIANCE storage

Your source code never leaves your infrastructure in plaintext.

Prerequisites

Three GitHub Actions secrets in your repository:

Secret	How to get it
STAMPED_TOKEN	Created automatically on stamped.so during onboarding
STAMPED_REGISTRY_ID	Your registry UUID, visible on stamped.so after sign-in
STAMPED_ENCRYPTION_KEY	Generate once: openssl rand -base64 32 — save it, Stamped never sees it

Usage

# .github/workflows/stamped.yml
name: Stamp Delivery

on:
  push:
    branches: [ main ]

jobs:
  stamp:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: foreground-team/stamped-github-actions@v1
        id: stamp
        with:
          token: ${{ secrets.STAMPED_TOKEN }}
          registry-id: ${{ secrets.STAMPED_REGISTRY_ID }}
          encryption-key: ${{ secrets.STAMPED_ENCRYPTION_KEY }}

      - name: Print verify URL
        run: echo "Proof of delivery → ${{ steps.stamp.outputs.verify-url }}"

Inputs

Input	Required	Default	Description
token	✅	—	Stamped API token (contributor role or above)
registry-id	✅	—	Registry UUID
encryption-key	✅	—	AES-256-GCM passphrase — never transmitted to Stamped
api-url	—	https://stamped.foreground.team	Override for staging or self-hosted
pbkdf2-iterations	—	100000	PBKDF2 iteration count for key derivation — must match when decrypting

Cipher: AES-256-CBC with PBKDF2 key derivation. GCM (-aes-256-gcm) was removed from openssl enc in OpenSSL 3.x (Ubuntu 22.04+). Payload integrity is guaranteed by Stamped's SHA-256 checksum verification at upload and finalize.

Outputs

Output	Description
release-id	UUID of the sealed release
signing-time	RFC 3161 certified signing time (ISO 8601)
verify-url	Public URL to verify the delivery proof independently

Verification

Anyone can verify a delivery proof offline using standard tools:

# Download the TST from the verify URL and check with openssl
openssl ts -verify -in timestamp.tsr -data payload.enc -CAfile evidency-ca.pem

Security

• Encryption key never leaves your runner — only the SHA-256 hash of the encrypted payload is sent to the Stamped API
• The Stamped server validates the hash at upload time (S3 x-amz-checksum-sha256)
• Sealed releases are stored in S3 Object Lock COMPLIANCE — immutable for 1–10 years depending on plan
• Timestamps are issued by Evidency, an ANSSI-listed (French national cybersecurity agency) qualified TSP