skills.rest
jfrog
jfrogOFFICIAL
Explore all skills by this author →
WebsiteGitHub

Apptrust Evidence Policies

Create AppTrust lifecycle policies enforcing required evidence before promotion via JFrog Unified Policy API.

5|1|Updated Mar 2, 2026
Search Tags:#compliance#evidence#lifecycle#policy#promotion#apptrust#unified-policy
One-click install
npx skills add https://github.com/jfrog/ai-agent-examples --skill apptrust-evidence-policies
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Apptrust Evidence Policies
Source: https://github.com/jfrog/ai-agent-examples/tree/main/compliance-and-policies/skills/apptrust-evidence-policies
Command: npx skills add https://github.com/jfrog/ai-agent-examples --skill apptrust-evidence-policies

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) components.

What problem does it solve?

This Skill helps teams enforce evidence-based promotion by creating policies that require certain evidence to be attached before promoting a release or application. It uses JFrog Unified Policy to implement templates, rules, and policies.

Core Features & Use Cases

  • Create Rego-based templates that check for a specific evidence predicate type.
  • Bind rules to templates and enforce policies scoped to a project or application.
  • Interactive guidance to configure predicate types, scope, and enforcement behavior for promotions.
  • Use cases include enforcing SLSA provenance, build-signature verification, and security/quality evidence before release.

Quick Start

Ask the agent to create an AppTrust policy by specifying the predicate type and scope, then follow the prompts to configure and apply the policy.

Frequently Asked Questions about Apptrust Evidence Policies

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce evidence-based promotion for JFrog projects?▼

Evidence-based promotion prevents unauthorized releases by requiring specific proof, like SLSA provenance or build-signatures, to be attached before a release. This Skill creates AppTrust policies to gate promotions until required evidence is verified.

How do I create a lifecycle policy that requires SLSA provenance before release?▼

You can gate releases by creating an AppTrust policy through interactive prompts. Specify the required predicate type and scope your policy to target specific applications or releasable assets using labels or application keys.

Can I scope evidence policies to specific applications or labels?▼

Yes, you can scope policies to specific applications or JFrog projects. Interactive prompts allow you to target releasable assets accurately by specifying application keys or labels during the policy creation process.

What is needed to configure AppTrust evidence policies via the Unified Policy API?▼

Configuring evidence policies via the Unified Policy API requires producing a template, a rule, and a policy. The Skill generates Rego-based templates to check for a specific evidence predicate type and binds rules to enforce them.

Are there limitations when gating promotions with AppTrust evidence policies?▼

AppTrust evidence policies gate promotions by enforcing required evidence presence before release. Limitations include dependency on the JFrog Unified Policy API and the need to correctly scope policies by labels or application keys to target releasable assets.

Related Skills

Explore More Legal & Compliance Skills→
jfrogjfrog
5

JFrog AppTrust

Automate application, version, and promotion governance in JFrog AppTrust.

Official
Advanced
DaBigHomieDaBigHomie
1

orchestration-standards-enforcer

Enforce orchestration standards across Prime-enrolled repositories with a four-gate stack.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

phase-2-automation-weeks-5-8

Automate CI/CD gate enforcement, SBOM generation, vulnerability scanning, and SLSA provenance.

Official
Advanced
haJ1thaJ1t

policy-as-code

Automate compliance and security policy enforcement in Kubernetes, Terraform, and CI/CD pipelines using OPA and Rego.

Community
Advanced