What is GitHub's 'Artifact attestation' feature for GitHub Actions?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Artifact attestations are your software provenance certificates. GitHub signs the artifact and links it cryptographically to the specific workflow run on a specific commit that built it. Consumers can verify the artifact came from your repo, your workflow, and hasn't been tampered with.
Full explanation below image
![Educational infographic showing GitHub Actions artifact attestation. Display build workflow: code commit → Actions workflow builds artifact → attest-build-provenance action creates attestation → attestation signed with GitHub OIDC → published to Sigstore transparency log. Show verification flow: consumer downloads artifact → gh attestation verify → verifies signature and provenance → confirms: built from [repo]@[commit] by [workflow]. Include Sigstore logo and provenance chain. Supply chain security green verification design. 1024x768 pixels.](/media/github/gh-100/GH-100-q150-infographic.webp)
Full Explanation
GitHub Actions Artifact Attestations (powered by Sigstore) provide cryptographic provenance for build artifacts. How it works: (1) During a workflow run, actions/attest-build-provenance captures metadata about the build: repository, commit SHA, workflow file, runner environment. (2) This provenance is signed using GitHub's OIDC identity and published to a transparency log (via Sigstore/Rekor). (3) The attestation is cryptographically linked to the specific artifact (via its hash). (4) Consumers can verify the attestation using the GitHub CLI ('gh attestation verify') to confirm: the artifact was built from a specific repository and commit, using a specific workflow, and hasn't been modified since. This addresses supply chain security by enabling consumers to verify artifact provenance — critical for high-stakes software distribution.