signed test results for CI

Run a heavy test once.
Reuse the result safely everywhere.

Aval signs a passing test result and ties it to the exact inputs it used. When another job has the same inputs and trusts the signer, it skips the test.

Get started How trust works GitHub

curl -fsSL https://aval.run/install.sh | bash

Windows: a PowerShell installer is in Install.

# REG=localhost:5055/acme/orders-aval
# first job: nothing signed for these inputs yet
$ aval run --push --key keys/ci.pem --registry $REG --policy policy.yaml
test integration fingerprint sha256:b40e9fac…
miss integration sha256:b40e9fac…
reason: registry.Lookup …: no attestation found for fingerprint
ran integration: passed (exit 0)
pushed localhost:5055/acme/orders-aval@sha256:2496759a…
# another job, same inputs
$ aval run --registry $REG --policy policy.yaml
test integration fingerprint sha256:b40e9fac…
verified integration sha256:b40e9fac…
reused passed result …/orders-aval@sha256:2496759a…$

// see it run

A miss runs the test. A match skips it.

Fingerprint. Aval hashes the inputs you list in aval.yaml.
Miss. No signed result for that fingerprint, so the test runs and --push signs the pass.
Verified. Same fingerprint, valid signature, a signer your policy trusts: the run is skipped and exits 0.

1run

Integration suite ran once on main and was signed.

37×

Reused by pull requests with the same inputs.

CI time saved this week. No result trusted blindly.

Example numbers.

// how it works

Three steps. No server to run.

01 · declare

List the inputs

Write the files and tools your test reads in aval.yaml. Aval hashes them into one fingerprint.

02 · sign

Run once, sign the result

On a miss the test runs. Aval signs the result and pushes it to your own OCI registry.

03 · reuse

Verify, then skip

Same fingerprint and a trusted signer? The run is skipped. Anything unclear, the test runs.

If Aval cannot prove reuse is safe, the test runs. A bad signature fails with exit 5, never a silent miss.