skills.rest
harness
harnessOFFICIAL
Explore all skills by this author →
WebsiteGitHub

sign-artifact

Automate SscaArtifactSigning step placement in Harness pipelines via interactive wizard.

80|16|Updated Mar 11, 2026
Search Tags:#devsecops#supply chain#harness#cosign#pipeline security#artifact signing#upload signature
One-click install
npx skills add https://github.com/harness/harness-skills --skill sign-artifact
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sign-artifact
Source: https://github.com/harness/harness-skills/tree/main/skills/sign-artifact
Command: npx skills add https://github.com/harness/harness-skills --skill sign-artifact

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Signing artifacts in Harness pipelines to ensure supply-chain integrity by cosigning after builds and optionally uploading signatures to registries.

Core Features & Use Cases

  • Supports keyless, key-based, and Vault signing across Docker, ECR, GCR, GAR, ACR, HAR, and Harness Local Stage.
  • Provides an interactive wizard to place the SscaArtifactSigning step after build/push and manage upload of signatures.
  • Integrates with Harness MCP v2 and uses harness_update to surgically modify existing pipelines without executing them.

Quick Start

Invoke the sign-artifact command to launch the interactive wizard and configure Artifact Signing in your existing pipeline.

Frequently Asked Questions about sign-artifact

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add artifact signing to a Harness pipeline?▼

To add artifact signing to a Harness pipeline, you use an interactive wizard to insert an SscaArtifactSigning step after your build and push stages, configuring Cosign to sign artifacts without executing the pipeline.

Does Cosign artifact signing support keyless and Vault-based methods?▼

Cosign artifact signing supports keyless, key-based, and Vault signing methods across Docker, ECR, GCR, GAR, ACR, and HAR registries to ensure supply-chain integrity within your Harness pipelines.

Can I upload Cosign signatures to third-party registries automatically?▼

You can optionally upload Cosign signatures to Docker and third-party registries by configuring the upload behavior during the interactive wizard setup of the artifact signing step.

What is the best way to cosign-sign artifacts without running the pipeline?▼

The best way to cosign-sign artifacts without running the pipeline is using harness_update to make surgical YAML edits, placing the SscaArtifactSigning step safely into your existing configuration.

When do I need artifact signing in my DevSecOps supply chain?▼

You need artifact signing in your DevSecOps supply chain when you must verify the integrity and provenance of container images or artifacts after building and before deployment to prevent tampering.

Related Skills

Explore More Software Engineering Skills→
AminAlamAminAlam
26

CI/CD Pipeline Design for Medical Devices

Design regulated CI/CD pipelines with compliance checks and artifact traceability.

Community
Advanced
vince-winkintelvince-winkintel
43

glab-attestation

Verify software attestations for artifacts in GitLab projects using glab.

Community
Intermediate
NickCrewNickCrew
29

security-testing-patterns

Identify and mitigate security vulnerabilities in CI/CD pipelines.

Community
Advanced
jeremylongshorejeremylongshore
2.6k

scanning-container-security

Scan container images and running containers for vulnerabilities using Trivy or Snyk.

Community
Intermediate