ci: add build provenance attestations for release artifacts#10316
Open
knqyf263 wants to merge 1 commit intoaquasecurity:mainfrom
Open
ci: add build provenance attestations for release artifacts#10316knqyf263 wants to merge 1 commit intoaquasecurity:mainfrom
knqyf263 wants to merge 1 commit intoaquasecurity:mainfrom
Conversation
Add SLSA build provenance attestations using actions/attest to the release workflow. This allows users to verify the origin of release artifacts with `gh attestation verify`. Changes: - Add attestations:write permission to reusable-release workflow - Add actions/attest step after GoReleaser (skipped for canary builds) - Set fixed checksums filename in goreleaser.yml for predictable path
knqyf263
added
the
kind/security
DmitriyLewen
reviewed
Mar 4, 2026
| if: ${{ inputs.goreleaser_config != 'goreleaser-canary.yml' }} | ||
| uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0 | ||
| with: | ||
| subject-checksums: dist/checksums.txt |
Contributor
There was a problem hiding this comment.
There is an issue with the install script. It currently expects a versioned filename:
Lines 393 to 394 in 75c4dc0
Because of this, http_download will fail when trying to fetch trivy_X.Y.Z_checksums.txt (instead of checksums.txt).
We either need to update the install script, or, alternatively, we can just specify the correct filename right here:
Suggested change
| subject-checksums: dist/checksums.txt | |
| subject-checksums: dist/trivy_${{ github.ref_name }}_checksums.txt |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add SLSA build provenance attestations to the release workflow using
actions/attest. While cosign keyless
signing already provides signature verification, attestations offer a
standardized SLSA format and simple verification via
gh attestation verify.Changes:
attestations: writepermission toreusable-release.yamlactions/[email protected]step after GoReleaser to generate attestationsfrom
dist/checksums.txtchecksum.name_template: checksums.txttogoreleaser.ymlfor apredictable filename
Tested on
aquasecurity/trivy-testwith a full release workflow run.Related issues
Checklist