Steps

Use the `slsa-framework/slsa-github-generator` reusable workflows for your artifact type (e.g., Go binary, container image, or generic artifact)
In your workflow, call the generator's reusable workflow via `uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@<pinned-tag>` and pass the artifact's digest as input
The generator workflow runs in an isolated, ephemeral environment, builds provenance, and signs it with Sigstore's Fulcio CA using the workflow's OIDC identity — no long-lived keys needed
Upload both the artifact and the `.intoto.jsonl` provenance attestation file to your GitHub release assets or container registry
Verify provenance with the `slsa-verifier` CLI: `slsa-verifier verify-artifact <artifact> --provenance-path <file> --source-uri github.com/YOUR_ORG/YOUR_REPO`
Pin the generator workflow to a specific tagged version (not a branch) to prevent dependency confusion attacks on your supply chain

Known gotchas

SLSA level 3 requires that the build runs in an isolated environment not controllable by the repository owner — using self-hosted runners downgrades the attainable level
The provenance is tied to the exact artifact digest; any post-build modification (repackaging, re-tagging) invalidates the attestation
Verifying provenance requires network access to Sigstore's transparency log (Rekor) — air-gapped environments need a private Rekor instance or offline verification workarounds

github.com/slsa-framework/slsa-github-generator · 5 steps · unrated

Generate SLSA Build Level 3 provenance for a non-container build artifact using the slsa-github-generator generic workflow

github.com/slsa-framework/slsa-github-generator · 5 steps · unrated

Generate SLSA Build Level 2 provenance attestations in GitHub Actions and verify with slsa-verifier

docs.github.com/actions/security-for-github-actions/using-artifact-attestations · 6 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans

Generate SLSA level 3 build provenance for a GitHub Actions workflow using slsa-github-generator

Steps

Known gotchas

Related routes

Give your agent this knowledge — and 15,500+ more routes

Need this verified for your stack — or a route we don't have yet?