CI Verification

Enforce “all AI content must be signed before merge” in CI using the Certivu CLI — no extra action or plugin to install. The CLI is on npm, so a single run: step works in any CI system.

GitHub Actions

name: Verify provenance
on: [pull_request]

jobs:
  certivu:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npx -y @certivu/cli verify "assets/ai-generated/**/*.{png,jpg,mp4}" --fail-on-missing

certivu verify accepts multiple files and glob patterns. The CLI expands the globs itself (quote them so the shell doesn’t), checks each file against the free public verify endpoint, prints one line per file plus a summary, and with --fail-on-missing exits non-zero if any file lacks valid provenance — failing the job.

Verification is free and needs no API key, so nothing to configure as a secret. To target the sandbox, add --base-url https://api-sandbox.certivu.ai.

Other CI systems

The same one-liner works anywhere Node is available:

# GitLab CI, CircleCI, Jenkins, etc.
npx -y @certivu/cli verify "build/**/*.png" --fail-on-missing

Why a CLI step instead of a dedicated Action?

A run: step has no repository or marketplace dependency, pins cleanly to a published CLI version (npx @certivu/[email protected] …), and works identically across CI providers — so there’s nothing extra to host or maintain.