Skip to main content

​
What the check does

Flags any workflow that:
  1. Publishes a release-shaped artifact — a step using one of softprops/action-gh-release, actions/upload-release-asset, docker/build-push-action, actions/upload-pages-artifact, or a run: line containing docker push, gh release upload|create, npm publish, cargo publish, twine upload, gem push, or goreleaser release, AND
  2. Does not contain any step from actions/attest-build-provenance / actions/attest, nor a uses: call into slsa-framework/slsa-github-generator/....

​
Why it matters

SLSA Build L2 requires that artifacts ship with signed provenance — a verifiable record of what built them, how, and from which source. Without provenance, downstream consumers cannot detect tampering.

​
Vulnerable example

​
Safe example

For Build L3, prefer the slsa-framework/slsa-github-generator reusable workflow over an in-job attestation step — see provenance-isolated.

​
Why no auto-fix

Provenance generation depends on what the workflow actually builds and where it publishes; injecting a generic attestation step would produce a broken build more often than a working one.