Which two statements correctly describe GitHub artifact attestations in Actions workflows? (Choose two)
Select all correct answers, then click Submit.
Short Explanation and Infographic
Attestations are about proving how a build artifact was produced — provenance for supply-chain security — not a substitute for IAM or a fork ban. Use them with signing/verification policies in deploy pipelines so prod only accepts builds from trusted workflows.
Full explanation below image
Full Explanation
The correct answers are verifiable provenance metadata and binding artifacts to build claims for supply-chain integrity. Artifact attestations complement SBOMs and signing strategies by recording how and where a binary was produced in GitHub Actions. Option B is false; access control remains mandatory and attestations do not replace IAM. Option D is false; attestations do not ban forks. Administrators should standardize attestation generation in reusable workflows, pin trusted builders, and enforce verification at deployment gates so production only accepts artifacts with expected provenance.