skills.rest
harness
harnessOFFICIAL
Explore all skills by this author →
WebsiteGitHub

generate-slsa

Add SLSA provenance steps to existing Harness pipelines after image build.

80|16|Updated Mar 11, 2026
Search Tags:#security#provenance#pipeline#slsa#harness#cosign#attestation
One-click install
npx skills add https://github.com/harness/harness-skills --skill generate-slsa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: generate-slsa
Source: https://github.com/harness/harness-skills/tree/main/skills/generate-slsa
Command: npx skills add https://github.com/harness/harness-skills --skill generate-slsa

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Add SLSA provenance to an existing Harness pipeline after image build/push to enable proper provenance and attestation flows.

Core Features & Use Cases

  • Add a SLSA Generation step (provenance) in CI after image build/push.
  • Support keyless, key-based, or Vault attestation and multiple registry providers.
  • Interactive wizard guides placement, source, digest, and update, and ensures SBOM sequencing where applicable.

Quick Start

Run the SLSA generation wizard with /generate-slsa to add a provenance step after your image build/push in an existing pipeline.

Frequently Asked Questions about generate-slsa

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add SLSA provenance to an existing Harness pipeline?▼

Adding SLSA provenance to a Harness pipeline involves using an interactive wizard to configure placement, source, digest, and attestation, which then automatically updates the pipeline YAML with a post-build provenance step.

What is SLSA provenance generation and when do I need it in a CI pipeline?▼

SLSA provenance generation creates verifiable metadata about your build process, and you need it in a CI pipeline after image build and push to enable proper supply chain attestation and security verification flows.

Does SLSA provenance generation support keyless, key-based, and Vault attestation?▼

SLSA provenance generation supports keyless, key-based, and Vault attestation methods, alongside multiple registry providers, and ensures proper SBOM sequencing where applicable within your pipeline.

Do I need Harness MCP v2 to generate SLSA provenance steps?▼

Generating SLSA provenance steps requires Harness MCP v2, as the interactive wizard needs this specific version to automatically update and modify your existing pipeline configuration with the necessary YAML.

What are the limitations of automating SLSA provenance generation in Harness?▼

Automating SLSA provenance generation in Harness is limited by enforced post-build placement, strict YAML step type provenance enforcement, and the absolute requirement for Harness MCP v2 to apply pipeline updates.

Related Skills

Explore More Software Engineering Skills→
thisrohanguptathisrohangupta
1

create-pipeline-v1

Generate Harness v1 Pipeline YAML with Python scripts and MCP v2 server.

Community
Advanced
haomingzhaomingz
12

glab-attestation

Verify software artifact attestations using glab and cosign in GitLab CI pipelines.

Community
Intermediate
harnessharness
80

manage-supply-chain

Automates Harness SSCA configuration to generate SBOMs, sign artifacts with Cosign, and enforce OPA policies.

Official
Advanced
RedHatProductSecurityRedHatProductSecurity
47

sbom-provenance

Generate SPDX and CycloneDX SBOMs with build provenance attestation.

Official
Intermediate