GitHub Action

The reusable verify action confirms a document hash is anchored on Stacks from inside any CI pipeline. It reads the public Hiro mainnet API directly and needs no wallet, secret, or signing key.

A typical use: a research lab anchors a dataset hash once, then confirms on every release that the artifact is still backed by an on-chain proof.

Usage

Hash a file in your repo and verify it:

- name: Verify dataset hash
  uses: Tim-cryptow/thesis-lock/action@main
  with:
    file: ./data/dataset.csv
    fail-on-unverified: "true"

Or verify a hash you already know:

- uses: Tim-cryptow/thesis-lock/action@main
  with:
    hash: "abc123..."

Verify a batch anchor by passing the anchoring wallet:

- uses: Tim-cryptow/thesis-lock/action@main
  with:
    file: ./data/dataset.csv
    owner: "SP3QS6X01XKTYC84BHA0J567CZTAH67BJHN88FNVM"

Inputs

Input	Description	Required	Default
`hash`	SHA-256 hash to verify (64 hex chars).	No
`file`	Path to a file to hash and verify.	No
`owner`	Stacks principal for batch anchor lookup.	No
`fail-on-unverified`	Fail the step if the hash is not verified.	No	`true`

Provide either hash or file. When file is set it takes precedence and the action computes the file's SHA-256 digest locally.

Outputs

Output	Description
`verified`	Whether the hash is verified on-chain (true/false).
`source`	Anchor source (single, batch, proof, group).
`block`	Stacks block number where the hash was anchored.
`label`	Label attached to the anchor.

Read the outputs in a later step:

- id: verify
  uses: Tim-cryptow/thesis-lock/action@main
  with:
    file: ./data/dataset.csv
    fail-on-unverified: "false"
- run: |
    echo "verified: ${{ steps.verify.outputs.verified }}"
    echo "source:   ${{ steps.verify.outputs.source }}"
    echo "block:    ${{ steps.verify.outputs.block }}"
    echo "label:    ${{ steps.verify.outputs.label }}"

How it works

If file is supplied, the action reads it and computes a SHA-256 digest. The file never leaves the runner.
It queries the public Hiro mainnet API with read-only contract calls: thesislock.get-anchor for single anchors, thesislock-batch.get-batch-anchor when an owner is supplied, and thesislock-proof.get-token-id-by-hash then get-proof for proof NFTs.
The first contract that holds the hash determines source, block, and label. If none do, the hash is not verified.
When fail-on-unverified is true (the default), an unverified hash fails the step so a broken proof can gate a release.

Prefer a plain command-line step? The CLI offers the same verification with thesislock hash --verify.