How to use this reference
Separate the question of where an artifact came from from whether its source and build process meet release requirements. Compare the expected build identity with recorded provenance before accepting a release. Treat claims from build infrastructure as evidence that still needs an explicit consumer policy.
Before reading
- Git commits and repositories
- Basic CI workflows
- Provenance and digital-signature concepts
Context and limits
- Generating attestations alone provides no benefit without verification, and attestations do not establish that code is secure.
- Public repository attestations use public transparency infrastructure; GitHub’s private instance has no transparency log and only federates with GitHub Actions.
- The page’s SLSA discussion explicitly refers to v1.0. Its claims should not be silently recast as v1.2 certification.
Sources and provenance
- Artifact attestations GitHub · reviewed 2026-10-12
Record reviewed 2026-10-12. Snapshot cb017eaea66e. Open the complete JSON contract.