add-artifact-attestations-to-workflow

Adds SLSA build-provenance attestations to GitHub Actions workflows for Docker builds.

21|Updated May 23, 2025

Search Tags:#github actions #provenance #docker #cicd #slsa #attestations

Ready to run

npx skills add https://github.com/jim60105/copilot-prompt --skill add-artifact-attestations-to-workflow

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: add-artifact-attestations-to-workflow
Source: https://github.com/jim60105/copilot-prompt/tree/main/skills/add-artifact-attestations-to-workflow
Command: npx skills add https://github.com/jim60105/copilot-prompt --skill add-artifact-attestations-to-workflow

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates the process of adding SLSA build-provenance attestations to your GitHub Actions workflows, enhancing the security and trustworthiness of your Docker image builds.

Core Features & Use Cases

Automated Attestation Generation: Integrates seamlessly with docker/build-push-action to capture build digests.
Multi-Registry Support: Configurable for various container registries like GHCR, Docker Hub, and Quay.
Use Case: Ensure your CI/CD pipeline for a critical microservice's Docker image generates verifiable attestations, proving its origin and integrity against potential supply chain attacks.

Quick Start

Add SLSA attestations to your GitHub Actions workflow by modifying the relevant workflow file.

Frequently Asked Questions about add-artifact-attestations-to-workflow

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I add SLSA build-provenance attestations to GitHub Actions workflows?▼

SLSA build-provenance attestations are verifiable records of how a Docker container image was built. They capture the build digest and workflow metadata, proving the image's origin and integrity against potential supply chain attacks in your CI/CD pipeline.

Can I use GitHub Actions attestations with Docker Hub or Quay registries?▼

Yes, GitHub Actions attestations support multiple container registries including GHCR, Docker Hub, and Quay. You must configure the necessary registry logins within your workflow to generate and attach build-provenance attestations for images pushed to these platforms.

Do I need to enable OIDC permissions for Docker build provenance attestations?▼

Yes, enabling OIDC and attestation permissions in your GitHub Actions workflow is required for Docker build provenance attestations. This identity configuration allows the attestation action to securely generate and sign the provenance metadata for your container images.

What's the best way to capture Docker build digests for SLSA attestations in CI/CD?▼

The best way to capture Docker build digests for SLSA attestations is to integrate with docker/build-push-action. This action captures the build digest, which the actions/attest-build-provenance action then uses to generate verifiable build records for your container images.