Verified:GitHub

glab-attestation

Verify software artifact attestations using glab and cosign in GitLab CI pipelines.

12|2|Updated Apr 21, 2026

Search Tags:#security #provenance #gitlab #verify #glab #attestation

One-click install

npx skills add https://github.com/haomingz/kimi-skills --skill glab-attestation-haomingz

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: glab-attestation
Source: https://github.com/haomingz/kimi-skills/tree/main/skills/gitlab-cli-guide/glab-attestation
Command: npx skills add https://github.com/haomingz/kimi-skills --skill glab-attestation-haomingz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Attestation management for software supply chain to verify provenance and ensure artifact integrity.

Core Features & Use Cases

Verify attestations for artifacts using glab attestation verify (EXPERIMENTAL) to ensure provenance across GitLab projects.
Access and interpret attestations via the GitLab Attestations API and SLSA provenance guidance for compliance.
Integrate with existing GitLab workflows to enforce software supply chain security during releases.

Quick Start

Run glab attestation --help to view available commands and begin verifying artifact attestations.

Frequently Asked Questions about glab-attestation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify GitLab attestations for software artifacts?▼

You can verify GitLab attestations by running the glab attestation verify command to check artifact provenance and security across GitLab projects within your CI pipelines.

What is artifact provenance and when do I need attestation verification?▼

Artifact provenance verifies the origin and integrity of software components. You need attestation verification in GitLab workflows to enforce software supply chain security and compliance during releases.

Do I need cosign to manage GitLab attestations?▼

Yes, you need the cosign binary to perform SLSA checks and verify provenance. The Skill uses glab's attestation commands alongside cosign to access and verify attestations across GitLab projects.

Can I access GitLab attestations through the API?▼

Yes, you can access and interpret attestations via the GitLab Attestations API. This allows you to retrieve SLSA provenance data for compliance and supply chain security verification.

How do I enforce supply chain security in GitLab CI pipelines?▼

You can enforce supply chain security by integrating glab attestation verify into your GitLab CI pipelines. This verifies artifact provenance and ensures integrity during software releases.

Are there limitations when verifying attestations across GitLab projects?▼

The glab attestation verify command is currently experimental. You must ensure both the cosign binary and glab are properly configured to successfully verify provenance and access attestations across projects.