tsa-integration.yml

# SPDX-License-Identifier: AGPL-3.0-or-later
name: tsa-integration

on:
  schedule:
    - cron: "23 5 * * 1" # weekly, Monday 05:23 UTC
  workflow_dispatch:

permissions:
  contents: read

jobs:
  public-tsa:
    name: stamp + verify against real public RFC 3161 authorities
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Install uv (pinned)
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          version: "0.11.19"
          enable-cache: true
      - name: Sync environment
        run: uv sync --frozen
      - name: Stamp + verify against public TSAs (only a hash is sent, never content)
        run: make integration