Agent Sign

Cryptographic provenance for AI agent instructions and packages
Sign SKILLS.md, CLAUDE.md and related artifacts with Sigstore and Nono keyless attestation, or publish full nono packages to the registry with the same GitHub Actions identity.

Quick Start | How It Works | Package Publishing | Inputs | Verification | nono CLI

---

Why?

AI agents read instruction files to determine what they can do. If those files are tampered with, the agent follows malicious instructions. nono packages raise the stakes further by distributing profiles, hooks, trust policy, and project instructions together. This action creates a cryptographic chain of trust for both cases: files can be signed in CI, and full nono packages can be signed and published with the same workflow identity.

The result is a **Sigstore bundle** containing a DSSE envelope with an in-toto statement, a Fulcio certificate (binding GitHub Actions OIDC identity to the signature), and a Rekor transparency log inclusion proof. No private keys involved — identity is derived from the CI workflow itself.

Quick Start

name: Sign files
on:
  push:
    branches: [main]
    paths:
    - 'SKILL.md'
    - 'scripts/some-script.py'

permissions:
  id-token: write
  contents: write

jobs:
  sign:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: nolabs-ai/agent-sign@v0.0.2

That's it. This signs all files matching the trust policy's `includes` patterns, commits the `.bundle` sidecars, and verifies the signatures as a smoke test.

Package Publishing

`agent-s