Scope, influences and mappings

Scope, influences and mappings

What the schema renders

The README says that the schema models what GitHub’s documentation says about workflows, reusable workflows, actions, rulesets and required checks, and about a workflow’s identity in provenance.¹ It names the source of each class: GitHub’s workflow syntax, reusable workflows and metadata syntax pages, the REST API’s rules and check runs pages at version 2026-03-10, and GitHub’s build type for SLSA provenance.

The schema header pins the REST API version and the SchemaStore commit of github-workflow.json and github-action.json, which are copied into src/github_actions/schema/schemastore/. A weekly workflow opens an issue when either changes.

Influences

The README names what shaped the design:

• SLSA. A workflow’s identity comes from GitHub’s build type for SLSA provenance, where a reusable workflow that signs provenance is the builder. A required check is a technical control of SLSA’s Source track, so lmodel/slsa holds the evidence that it held.
• The OpenSSF Baseline and Scorecard. Their controls read a workflow’s inputs, its permissions, a branch’s required status checks and dependency pinning, so those facts are fields.
• otterdog. It gave the rule that a called job’s check is named caller job / called job, with a space on each side of the slash.
• LOKF and the Knowledge Trust Ladder (KTL). They gave the naming rule, the classes rooted on Concept, and the inlined value classes, which let lokf adapt run without --fold.
• lmodel/slsa. It gave the module layout, the release asset and the governance files.

Mappings

The README says that the schema maps to three vocabularies.

• CycloneDX 1.7. GhaWorkflow and GhaAction are close to its workflow and task, and triggers is related to its trigger.
• SPDX 3.0.1. Its Build records a run of a workflow, so it is a related term for GhaWorkflow, not a close one.
• in-toto’s Test Result predicate. It records what a required check found, so it is a related term for GhaRequiredStatusCheck, not a close one.

The workflow module declares the prefixes cdx: and spdx_build: for the first two.² The rules module declares in_toto: as https://in-toto.io/attestation/ and names the predicate in_toto:test-result/v0.1.³

Not modelled

• Runs and events, such as CDEvents and GitHub’s run logs, are records, not facts of a file. docs/about.md adds that the model holds no run, job run or check run, and no workflow ref.⁴
• GUAC, a graph of SBOMs, provenance and scores, consumes models like this one.
• SCITT and RATS define how evidence is carried and what it means, and need no class here.
• docs/about.md also says that the model has no step of a job and no parameter of a ruleset’s rules other than its required status checks, and that it names secrets and never holds their values.

Footnotes

1. README.md, the What it models, Influences, Mappings and Not modelled here sections ↩

2. src/github_actions/schema/github_actions_workflow.yaml, the prefixes and the mappings of GhaWorkflow and triggers ↩

3. src/github_actions/schema/github_actions_rules.yaml, the prefixes and the related mapping of GhaRequiredStatusCheck ↩

4. docs/about.md, the What is left out section ↩