actions/Generate Generic Attestations

Generate attestations for build artifacts

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 10, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
subject-path	Path to the artifact serving as the subject of the attestation. At most one of "subject-path", "subject-digest", or "subject-checksums" may be provided. May contain a glob pattern or list of paths (total subject count cannot exceed 1024). If none of these inputs are provided, subjects are discovered from the runner-provided $GITHUB_ARTIFACTS_LIST environment variable.	no	—
subject-digest	Digest of the subject for the attestation. Must be in the form "algorithm:hex_digest" (e.g. "sha256:abc123..."). At most one of "subject-path", "subject-digest", or "subject-checksums" may be provided. If none are provided, subjects are discovered from $GITHUB_ARTIFACTS_LIST.	no	—
subject-name	Subject name as it should appear in the attestation. Required when identifying the subject with the "subject-digest" input.	no	—
subject-checksums	Path to checksums file containing digest and name of subjects for attestation. At most one of "subject-path", "subject-digest", or "subject-checksums" may be provided. If none are provided, subjects are discovered from $GITHUB_ARTIFACTS_LIST.	no	—
subject-version	Version of the subject for the attestation. Only used when "push-to-registry" and "create-storage-record" are both set to true.	no	—
sbom-path	Path to the JSON-formatted SBOM file (SPDX or CycloneDX) to attest. File size cannot exceed 16MB. When provided, creates an SBOM attestation. Cannot be used together with "predicate-type", "predicate", or "predicate-path".	no	—
predicate-type	URI identifying the type of the predicate. Required when using "predicate" or "predicate-path" for custom attestations.	no	—
predicate	String containing the value for the attestation predicate. String length cannot exceed 16MB. Must supply exactly one of "predicate-path" or "predicate" when creating custom attestations.	no	—
predicate-path	Path to the file which contains the content for the attestation predicate. File size cannot exceed 16MB. Must supply exactly one of "predicate-path" or "predicate" when creating custom attestations.	no	—
push-to-registry	Whether to push the attestation to the image registry. Requires that the resolved subject is a single fully-qualified OCI image reference with a SHA-256 digest, whether specified explicitly (via any subject input) or discovered from the runner-provided artifacts list. Defaults to false.	no	false
create-storage-record	Whether to create a storage record for the artifact. Requires that push-to-registry is set to true. Defaults to true.	no	true
show-summary	Whether to attach a list of generated attestations to the workflow run summary page. Defaults to true.	no	true
github-token	The GitHub token used to make authenticated API requests.	no	${{ github.token }}

Outputs

name	description
bundle-path	The path to the file containing the attestation bundle.
attestation-id	The ID of the attestation.
attestation-url	The URL for the attestation summary.
storage-record-ids	The IDs of the storage records created for the artifact.