Question

Your team builds a container image in a CI workflow and generates a build provenance attestation using the actions/attest-build-provenance action. Before the deploy job pulls and runs the image in production, you want to confirm that the image was genuinely produced by your trusted workflow and has not been swapped or tampered with. Which step correctly verifies the attestation as part of the deployment gate?

Accepted Answer

Run `gh attestation verify oci:// --repo /` (optionally with `--signer-workflow`) in the deploy job so the signed provenance is validated against the specific trusted repository/workflow, not just the owner, before running the container.

Answer

Re-download the build artifact and compare its SHA-256 checksum to a value hard-coded in the workflow file.

Answer

Add `permissions: id-token: write` to the deploy job so the OIDC token automatically confirms image integrity at pull time.

Answer

Enable branch protection with required reviewers on the main branch so only reviewed commits can produce images.