Question

Your team ships a container image built in a GitHub Actions workflow, and your security team now requires cryptographically verifiable provenance (SLSA build metadata) tied to the build. You want to generate this attestation directly in the workflow using GitHub's native tooling, with the least additional infrastructure. Which combination of workflow configuration correctly produces a signed provenance attestation for the built artifact?

Accepted Answer

Add `permissions: id-token: write` and `attestations: write`, then use the `actions/attest-build-provenance` action referencing the built artifact's subject path or image digest.

Answer

Add `permissions: contents: write`, then upload the artifact with `actions/upload-artifact` and set its `retention-days` to the maximum so the provenance is preserved.

Answer

Store a long-lived signing key in a repository secret and run `cosign sign` in an inline `run:` step referencing that secret.

Answer

Enable required reviewers on the deployment environment so that a human approves the artifact, which GitHub records as the provenance attestation.