Question

Your team builds a container image in a GitHub Actions workflow and generates a build provenance attestation using the actions/attest-build-provenance action. A separate deployment workflow, running on a self-hosted runner in your production cluster, must refuse to deploy any image whose provenance cannot be confirmed as built by your organization's repository. Which approach correctly enforces this in the deployment workflow?

Accepted Answer

Run `gh attestation verify oci:// --repo /` and fail the job if the command returns a non-zero exit code before proceeding to deploy

Answer

Add the `id-token: write` permission to the deployment job so the runner can automatically validate provenance during image pull

Answer

Check that the artifact attestation file was uploaded as a workflow artifact in the build run and download it before deploying

Answer

Re-run actions/attest-build-provenance in the deployment workflow to regenerate the attestation and compare its digest to the image