gha-release-pipeline

Design GitHub release pipelines with SBOM and provenance attestations.

Updated Feb 18, 2026

Search Tags:#security #release #provenance #github-actions #ci-cd #sbom #artifact-publishing

Ready to run

npx skills add https://github.com/askaret/codex-skills --skill gha-release-pipeline

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gha-release-pipeline
Source: https://github.com/askaret/codex-skills/tree/main/.agents/skills/gha-release-pipeline
Command: npx skills add https://github.com/askaret/codex-skills --skill gha-release-pipeline

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Release workflows are often opaque and error-prone, making it difficult to guarantee reproducible builds, verifiable provenance, and safe artifact publishing during software releases.

Core Features & Use Cases

Ensure releases come from a clean, tagged source of truth and are auditable.
Integrate SBOM and provenance attestations into the release process to meet compliance needs.
Isolate publishing credentials and enforce least privilege across environments with explicit permissions and guards.

Quick Start

Configure a GitHub Actions workflow to build, attest, and publish release artifacts with SBOM provenance.

Frequently Asked Questions about gha-release-pipeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I generate SBOM and provenance attestations in a GitHub Actions release pipeline?▼

To generate SBOM and provenance attestations in a GitHub Actions release pipeline, configure the workflow to build, attest, and publish artifacts. This ensures deterministic builds and auditable artifacts with verifiable provenance.

What is the best way to enforce least privilege and isolate publishing credentials in GitHub Actions?▼

The best way to enforce least privilege and isolate publishing credentials in GitHub Actions is by applying explicit permissions and environment isolation. This prevents unauthorized releases during the artifact publishing workflow.

Can I use tag-driven and manual workflows to create reproducible GitHub release pipelines?▼

Yes, you can use tag-driven, release-driven, or manual workflows to create reproducible GitHub release pipelines. These scenarios ensure releases come from a clean, tagged source of truth and remain fully auditable.

How do I ensure my GitHub release artifacts come from a clean source of truth?▼

To ensure GitHub release artifacts come from a clean source of truth, design reproducible pipelines that enforce explicit permissions and guards. Integrating SBOM generation provides compliance and verifies the build origin.

Why does my GitHub Actions release workflow lack auditable provenance for compliance needs?▼

A GitHub Actions release workflow lacks auditable provenance if it does not integrate SBOM and provenance attestations. Adding these attestations to the publishing process guarantees verifiable, deterministic builds for compliance.

Do I need explicit permissions to prevent unauthorized releases in GitHub Actions CI/CD?▼

Yes, you need explicit permissions to prevent unauthorized releases in GitHub Actions CI/CD. Enforcing environment isolation and least privilege across environments secures the publishing workflow and protects release integrity.