skills.rest
jim60105
jim60105COMMUNITY
Explore all skills by this author →
Website𝕏@jim60105GitHub

add-artifact-attestations-to-workflow

Adds SLSA build-provenance attestations to GitHub Actions workflows for Docker builds.

21|Updated May 23, 2025
Search Tags:#github actions#provenance#docker#cicd#slsa#attestations
One-click install
npx skills add https://github.com/jim60105/copilot-prompt --skill add-artifact-attestations-to-workflow
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: add-artifact-attestations-to-workflow
Source: https://github.com/jim60105/copilot-prompt/tree/main/skills/add-artifact-attestations-to-workflow
Command: npx skills add https://github.com/jim60105/copilot-prompt --skill add-artifact-attestations-to-workflow

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates the process of adding SLSA build-provenance attestations to your GitHub Actions workflows, enhancing the security and trustworthiness of your Docker image builds.

Core Features & Use Cases

  • Automated Attestation Generation: Integrates seamlessly with docker/build-push-action to capture build digests.
  • Multi-Registry Support: Configurable for various container registries like GHCR, Docker Hub, and Quay.
  • Use Case: Ensure your CI/CD pipeline for a critical microservice's Docker image generates verifiable attestations, proving its origin and integrity against potential supply chain attacks.

Quick Start

Add SLSA attestations to your GitHub Actions workflow by modifying the relevant workflow file.

Frequently Asked Questions about add-artifact-attestations-to-workflow

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add SLSA build-provenance attestations to GitHub Actions workflows?▼

SLSA build-provenance attestations are verifiable records of how a Docker container image was built. They capture the build digest and workflow metadata, proving the image's origin and integrity against potential supply chain attacks in your CI/CD pipeline.

Can I use GitHub Actions attestations with Docker Hub or Quay registries?▼

Yes, GitHub Actions attestations support multiple container registries including GHCR, Docker Hub, and Quay. You must configure the necessary registry logins within your workflow to generate and attach build-provenance attestations for images pushed to these platforms.

Do I need to enable OIDC permissions for Docker build provenance attestations?▼

Yes, enabling OIDC and attestation permissions in your GitHub Actions workflow is required for Docker build provenance attestations. This identity configuration allows the attestation action to securely generate and sign the provenance metadata for your container images.

What's the best way to capture Docker build digests for SLSA attestations in CI/CD?▼

The best way to capture Docker build digests for SLSA attestations is to integrate with docker/build-push-action. This action captures the build digest, which the actions/attest-build-provenance action then uses to generate verifiable build records for your container images.

Related Skills

Explore More Software Engineering Skills→
liumeixinliumeixin
4

GitHub Actions Docker 自动构建

Automate Docker image builds and pushes to Docker Hub and GHCR via GitHub Actions.

Community
Intermediate
jeremylongshorejeremylongshore
2.6k

scanning-container-security

Scan container images and running containers for vulnerabilities using Trivy or Snyk.

Community
Intermediate
AGIBuildAGIBuild
10

dotnet-gha-publish

Automate .NET artifact publishing from GitHub Actions with conditional triggers.

Community
Advanced
zerAdazerAda

supply_chain_security

Sign Docker images with Cosign and generate SBOMs for supply chain security.

Community
Advanced