Skip to main content
Pipefort scores every scanned repository against the SLSA v1.2 specification. Two tracks are covered:
  • Build track — how artifacts are produced (Levels 1–3). Workflow-YAML checks live here.
  • Source track — how source code is managed (Levels 1–4). Repository- settings checks (branch protection, etc.) live here.
The dedicated SLSA dashboard renders both tracks side-by-side with per-control pass/fail heatmaps and a “lowest-scoring repositories” list.

​
Build track

Run pipefort -r slsa-build-l2 (or any level) to filter the CLI to just these rules. The web app’s /slsa page exposes the same filter on the API call.

​
Level definitions

​
Source track

These rules need the GitHub App’s extended permissions so Pipefort can read repository settings.

​
Level definitions

​
How the SLSA level is computed per repo

A repo passes level L when no enabled rule tagged for that level (or any lower level) fired in its latest scan. The dashboard’s Level Ladder widget shows the score per track and the count of passing controls at each level. Repositories without a recent scan show as L0 (Build) and L1 (Source) — the latter because a GitHub-hosted repo trivially satisfies Source L1 (Version Controlled).