Name associated with the file generator-generic-ossf-slsa3-publish.yml.
Possible roles: contributor, reviewer, or comment author. Below are ways to explore this connection.
+ +Standard location in a repo: .github/workflows/generator-generic-ossf-slsa3-publish.yml
Part of the SLSA GitHub Generator β a framework to generate provenance for SLSA Level 3.
+ +...yml#LThe #L suffix indicates a specific line number in a file on GitHub. The full URL would be:
https://github.com/<owner>/<repo>/blob/<branch>/.github/workflows/generator-generic-ossf-slsa3-publish.yml#L42
+ If you have the repository name and line number, you can build the correct link using the pattern above.
+ + +For demonstration, hereβs a non-working placeholder (but you can see the format):
+ https://github.com/octocat/hello-world/blob/main/.github/workflows/generator-generic-ossf-slsa3-publish.yml#L23 (not a real file)
SLSA provenance (e.g., intoto.jsonl) proves how an artifact was built and that it came from your source.
You can call this workflow from your own GitHub Actions by using uses: slsa-framework/...
Provenance is signed using OIDC, so consumers can trust it wasn't tampered with.
+ About OIDC β +SLSA (pronounced βsalsaβ) provides a set of incrementally adoptable security guidelines that help both producers and consumers verify that software artifacts havenβt been tampered with and can be traced back to their source. The core of SLSA is provenance β verifiable metadata describing how an artifact was built.
+ + +No provenance produced. No security expectations.
+ default +Provenance is generated, but it can be forged by the build process.
+ scripted build +Provenance is generated by a hosted build platform and signed. Prevents tampering after build.
+ signed provenance +Provenance cannot be forged even by the build process: isolated, ephemeral environments, and secrets protected.
+ nonβforgeable +Requirements (per slsa.dev):
+This reusable workflow from the SLSA GitHub Generator builds a generic artifact and generates SLSA Level 3 provenance. Below is the canonical content (simplified for clarity). π View original on GitHub
+# generator-generic-ossf-slsa3-publish.yml
+# Reusable workflow for SLSA Level 3 provenance (generic artifact)
+
+on:
+ workflow_call:
+ inputs:
+ artifact-path:
+ description: 'Path to the artifact(s)'
+ required: true
+ type: string
+ provenance-name:
+ description: 'Provenance file name'
+ required: false
+ type: string
+ default: 'provenance.intoto.jsonl'
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+ - run: | # user-defined build
+ mkdir -p $(dirname "${{ inputs.artifact-path }}")
+ touch "${{ inputs.artifact-path }}"
+ - uses: actions/upload-artifact@v4
+ with:
+ name: artifact-for-provenance
+ path: ${{ inputs.artifact-path }}
+
+ provenance:
+ runs-on: ubuntu-latest
+ needs: build
+ steps:
+ - uses: actions/checkout@v4
+ - uses: actions/download-artifact@v4
+ with:
+ name: artifact-for-provenance
+ - uses: slsa-framework/slsa-github-generator/actions/generator@v1.7.0
+ id: generate
+ with:
+ artifact-path: ${{ inputs.artifact-path }}
+ provenance-name: ${{ inputs.provenance-name }}
+ - uses: actions/upload-artifact@v4
+ with:
+ name: ${{ inputs.provenance-name }}
+ path: ${{ steps.generate.outputs.provenance-path }}
+
+
+ | Platform | Isolation method | Signing / key management | Provenance verification |
|---|---|---|---|
| GitHub Actions | Hosted runners (fresh VM per job) | GitHubβmanaged Sigstore (OIDC) | gh attestation verify |
| GitLab (proposed) | Ephemeral runners, signing in backend | Sigstore + OIDC | planned |
| Tanzu / kpack | Kubernetes pods per build, RBAC | cosign keys in k8s secrets | cosign verify-attestation |
| Bitnami | Ephemeral agents, control plane orchestration | Vaultβstored keys | cosign with public key |
| Harness SCS | New infrastructure per run (ephemeral) | cosign or HashiCorp Vault | Harness builtβin verification |
| Chainguard | QEMU microVMs in k8s pods (hypervisor isolation) | Sigstack (managed Sigstore) | cosign / slsa-verifier |
| Minimus | Ephemeral sandbox runners | Sigstore, secrets injected at runtime | slsa-verifier |
| Constellation | GitHubβhosted runners | OIDC + Sigstore | gh attestation verify |
gh attestation verify --signer-workflow <repo>/.github/workflows/β¦cosign verify-attestation --key <pubkey> --type slsaprovenance1 <image>docker scout attest get --verify <image>slsa-verifier verify-artifact --source-uri β¦ --provenance-path β¦#L indicates a GitHub permalink to a specific line. A complete URL looks like:https://github.com/<owner>/<repo>/blob/<branch>/.github/workflows/generator-generic-ossf-slsa3-publish.yml#L42
+