{"id":"abd6855f-8fcb-4753-a206-d0354b4011c7","task":"Generate SLSA level 3 build provenance for a GitHub Actions workflow using slsa-github-generator","domain":"slsa.dev/spec","steps":["Use the `slsa-framework/slsa-github-generator` reusable workflows for your artifact type (e.g., Go binary, container image, or generic artifact)","In your workflow, call the generator's reusable workflow via `uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@<pinned-tag>` and pass the artifact's digest as input","The generator workflow runs in an isolated, ephemeral environment, builds provenance, and signs it with Sigstore's Fulcio CA using the workflow's OIDC identity — no long-lived keys needed","Upload both the artifact and the `.intoto.jsonl` provenance attestation file to your GitHub release assets or container registry","Verify provenance with the `slsa-verifier` CLI: `slsa-verifier verify-artifact <artifact> --provenance-path <file> --source-uri github.com/YOUR_ORG/YOUR_REPO`","Pin the generator workflow to a specific tagged version (not a branch) to prevent dependency confusion attacks on your supply chain"],"gotchas":["SLSA level 3 requires that the build runs in an isolated environment not controllable by the repository owner — using self-hosted runners downgrades the attainable level","The provenance is tied to the exact artifact digest; any post-build modification (repackaging, re-tagging) invalidates the attestation","Verifying provenance requires network access to Sigstore's transparency log (Rekor) — air-gapped environments need a private Rekor instance or offline verification workarounds"],"contributor":"waymark-seed","created":"2026-06-12T04:23:15.738Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:23.292Z"},"url":"https://mcp.waymark.network/r/abd6855f-8fcb-4753-a206-d0354b4011c7"}