Prove when your code existed. One YAML file. Bitcoin-verified.

Every git push → your entire repository is snapshotted, hashed, and anchored to Bitcoin. The proof is independently verifiable by anyone, forever, without trusting Umarise.

push → snapshot → SHA-256 hash → Bitcoin anchor → .proof artifact

Your source code never leaves the runner. Only the hash is sent.

Add one file to your repo: .github/workflows/anchor.yml

name: Anchor to Bitcoin

on:
  push:
    branches: [main]

jobs:
  anchor:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Create deterministic snapshot
        run: |
          tar --sort=name \
              --mtime='UTC 1970-01-01' \
              --owner=0 --group=0 --numeric-owner \
              -cf build.tar .
          gzip -n -f build.tar

      - name: Anchor to Bitcoin
        uses: AnchoringTrust/anchor-action@v1
        with:
          file: build.tar.gz
        env:
          UMARISE_API_KEY: ${{ secrets.UMARISE_API_KEY }}

That's it. 26 lines. No SDK. No dependency. No code change.

Every push to main now produces a .proof file — uploaded as a GitHub Actions artifact. On Pull Requests, a comment is automatically posted with the anchor status:

✅ Anchored by Umarise

Field	Value
Hash	sha256:a1b2c3...
Origin ID	f47ac10b-...
Status	Bitcoin Confirmed

✅ Last tested: April 7, 2026 — 100% working.

Privacy: Your source code never leaves the CI runner. Only a 64-character hash is transmitted.

The tar command uses fixed timestamps, sort order, and ownership to ensure the same code always produces the same hash. Without this, identical code would produce different hashes on different runs.

⚠️ Do not use tar czf build.tar.gz . — this produces non-deterministic archives and inconsistent hashes.

No account needed. No trust required.

pip install umarise
umarise verify build.tar.gz.proof
# ✓ Hash match | Bitcoin Block #939611 | 2026-03-06 | VALID

Or drag-and-drop at verify-anchoring.org.

Or with standard tools:

unzip build.tar.gz.proof
sha256sum build.tar.gz        # compare with certificate.json
ots verify proof.ots          # verify against Bitcoin

Authentication: Set UMARISE_API_KEY as a repository secret (Settings → Secrets → Actions).

💡 Tip: One key, multiple repos. Your API key is not repo-specific. Use the same key across all your repositories to keep all anchors under one account and avoid wasting your 100 free sandbox anchors.

💡 Tip: PR comments work automatically. The action uses the default github.token — no extra secrets needed. To disable, set pr-comment: false.

💡 Tip: Naming the workflow file. When creating the file on GitHub (Add file → Create new file), type the full path .github/workflows/anchor.yml in the filename field — GitHub creates the folders automatically.

⚠️ Default branch must be main. The workflow triggers on branches: [main]. If your repository uses a different default branch name (e.g. master, develop), either rename it (Settings → General → Default branch) or change branches: [main] in the YAML to match.

Get your free API key at umarise.com/developers.

Your .proof files are uploaded as GitHub Actions artifacts (90-day retention by default). For long-term storage:

• Commit proofs to your repo in a proofs/ directory — they become part of your git history
• Keep the original artifact (build.tar.gz) alongside its .proof — you need both to verify
• Backup to external storage (S3, GCS, etc.) for audit-critical proofs

Code signing proves who. SBOMs prove what. Anchoring proves when.

build → test → deploy → anchor

A .proof file next to a .sig and .sbom completes the audit trail.

1. Get an API key at umarise.com/developers (100 free anchors, no credit card)
2. Add UMARISE_API_KEY to your repo secrets (Settings → Secrets → Actions)
3. Copy the YAML above to .github/workflows/anchor.yml
4. Push. Done.

💡 Still stuck? Open an issue at github.com/AnchoringTrust/anchor-action or email support@umarise.com.

• Get API key
• Live case study: 4,000+ anchored artifacts
• Independent verifier
• Open specification
• CLI & Python SDK
• Node.js SDK

Unlicense (Public Domain)