hardened-release-workflow

SLSA provenance is generated by automating your CI/CD pipeline to produce verifiable artifact attestations during the release process. This Skill automates that generation, ensuring verifiable, signed releases for your software supply chain.

Signed artifact attestations are cryptographically secured metadata proving a release artifact was built correctly. You need them when your production environment requires verifiable software supply chain security and minimal-permission releases.

You set up a hardened release workflow by integrating SHA-pinned actions and minimal permissions into your CI/CD configuration. This ensures reproducible builds and safer software releases across protected production environments.

Yes, this approach supports immutable releases by enforcing tag protection and production environment protections. This prevents unauthorized updates to your signed artifacts after the hardened release workflow completes.

The best way to enforce minimal permissions is by using action pinning and environment protection rules within your release workflow. This limits unauthorized access and meets production-grade security requirements for your software supply chain.

Signature verification can fail if the CI/CD pipeline lacks proper artifact attestations or if environment protections are misconfigured. This Skill automates signature verification to ensure provenance matches your immutable releases.