Generate SLSA Build Level 2 provenance attestations in GitHub Actions and verify with slsa-verifier

Steps

1. Add the actions/attest-build-provenance step to your GitHub Actions workflow after the build step, pointing subject-path at your built artifact or image digest.
2. Ensure the workflow has id-token: write permission so GitHub Actions can request an OIDC token for Sigstore-based signing.
3. The action generates a Sigstore-signed in-toto provenance statement and uploads it to GitHub's attestation store, returning an attestation ID.
4. Download the attestation bundle for an artifact using the GitHub CLI: gh attestation download ARTIFACT_PATH -R org/repo.
5. Verify the provenance locally or in CI using slsa-verifier: slsa-verifier verify-artifact ARTIFACT_PATH --provenance-path provenance.json --source-uri github.com/org/repo.
6. Inspect the provenance predicate to confirm the builder ID, source commit SHA, and workflow path match expected values before promoting an artifact to production.