jurgen-paul/Attest Build Provenance

Generate provenance attestations for build artifacts

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Maintainedlast commit Feb 15, 2025
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: jurgen-paul/llama-meta-@21da6f9896fc0bd2ac30b37850831c24dca52df3 # no releases — HEAD as of 2026-07-11

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
subject-path	Path to the artifact serving as the subject of the attestation. Must specify exactly one of "subject-path" or "subject-digest". May contain a glob pattern or list of paths (total subject count cannot exceed 2500).	no	—
subject-digest	Digest of the subject for which provenance will be generated. Must be in the form "algorithm:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one of "subject-path" or "subject-digest".	no	—
subject-name	Subject name as it should appear in the provenance statement. Required unless "subject-path" is specified, in which case it will be inferred from the path.	—	—
push-to-registry	Whether to push the provenance statement to the image registry. Requires that the "subject-name" parameter specify the fully-qualified image name and that the "subject-digest" parameter be specified. Defaults to false.	no	false
show-summary	Whether to attach a list of generated attestations to the workflow run summary page. Defaults to true.	no	true
github-token	The GitHub token used to make authenticated API requests.	no	${{ github.token }}

Outputs

name	description
bundle-path	The path to the file containing the attestation bundle(s).