Repository-native distribution

Publish metadata where robotics work already lives.

The Action sends only the repository URL, immutable commit and descriptive artifact type. KnownRobot fetches its approved metadata allowlist and never executes the policy.

1. Create a scoped token

Create a 180-day token in your account workspace, store it as KNOWNROBOT_TOKEN, and rotate or revoke it there.

2. Add the workflow

name: Publish KnownRobot metadata
on:
  push:
    branches: [main]
    paths: [README.md, LICENSE, LICENSE.md, config.json, policy_config.json, dataset_info.json, robot_config.json]
jobs:
  knownrobot:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: arcofdescent1/knownrobot/.github/actions/knownrobot@main
        with:
          source-url: https://github.com/OWNER/REPOSITORY
          revision: ${{ github.sha }}
          artifact-type: policy
          token: ${{ secrets.KNOWNROBOT_TOKEN }}

Portable endpoints

• GET /api/v1/artifacts/:slug — complete public export
• POST /api/v1/imports — authenticated, idempotent metadata import
• /artifacts/:slug/compatibility.json — attempt-specific compatibility evidence
• /artifacts/:slug/badge.svg — evidence summary badge

Imports accept source_url, revision, and artifact_type. Tokens are shown once and stored only as hashes.