v2.4.0

Downloads capiscio-core v2.4.0 binaries

Changed

• CORE VERSION: Now downloads capiscio-core v2.4.0

Added

• PoP Protocol (RFC-003): Badge issuance via Proof of Possession for IAL-1 verification
• Staleness Fail-Closed: Badges now fail validation when stale (security hardening)
• MCP Service: Server identity operations support

v2.3.1

What's Changed

• chore: bump version to 2.3.1 by @beonde in #3

Full Changelog: v2...v2.3.1

v2.2.0

What's Changed

• feat: update to capiscio-core v2.2.0 by @beonde in #2

Full Changelog: v1...v2.2.0

v1.1.0

Changed

• Core Migration: Migrated from legacy Node.js CLI (capiscio-cli) to high-performance Go binary (capiscio-core v1.0.2).
• Performance: Removed npm install -g step, significantly reducing action startup time.
• Platform Support: Added native support for Linux, macOS, and Windows runners (AMD64/ARM64).
• License: Changed license from MIT to Apache-2.0 to align with the CapiscIO ecosystem.

Fixed

• Improved error handling during binary download and execution.

v1.0.0

v1.0.0 - Initial Release

🚀 Validate A2A Agent Cards in GitHub Actions

GitHub Action to validate A2A protocol agent cards with three-dimensional scoring, cryptographic verification, and live endpoint testing.

Powered by capiscio-cli v2.0.0

✨ Features

• Three-Dimensional Scoring - Compliance, Trust, and Availability evaluation
• JWS Signature Verification - Cryptographic authenticity validation
• Live Endpoint Testing - Real A2A protocol message testing (optional)
• Production Readiness - Clear thresholds for deployment decisions
• Rich Outputs - Scores, errors, warnings available for downstream workflow steps
• Flexible Configuration - Support for strict mode, custom timeouts, and more

📊 Scoring System

Compliance (0-100) - A2A v0.3.0 specification adherence
Trust (0-100) - Security and authenticity (includes confidence multiplier)
Availability (0-100) - Operational readiness (requires test-live: true)

Production Ready Thresholds: Compliance ≥95, Trust ≥60, Availability ≥80

🎯 Quick Start

- name: Validate A2A Agent Card
  uses: capiscio/validate-a2a@v1
  with:
    agent-card: './agent-card.json'

📝 Inputs

• agent-card - Path to agent-card.json or URL (default: ./agent-card.json)
• strict - Enable strict validation mode (default: false)
• test-live - Test live endpoint with real messages (default: false)
• skip-signature - Skip JWS signature verification (default: false)
• timeout - Request timeout in milliseconds (default: 10000)
• fail-on-warnings - Fail action on validation warnings (default: false)

📤 Outputs

• result - Validation result (passed or failed)
• compliance-score - Compliance score (0-100)
• trust-score - Trust score (0-100)
• availability-score - Availability score or not-tested
• production-ready - Meets production thresholds (true or false)
• error-count - Number of validation errors
• warning-count - Number of validation warnings

📚 Documentation

See the README for comprehensive examples and usage patterns.

🔗 Related

• capiscio-cli - The underlying CLI tool