{"id":"cbec9197-df1f-4558-a054-09e6402c5c0a","task":"Generate SLSA Build Level 3 provenance for a generic artifact using the slsa-github-generator generic reusable workflow in GitHub Actions","domain":"github.com/slsa-framework/slsa-github-generator","steps":["In your GitHub Actions workflow, build the artifact in an initial job and compute its SHA256 hash, then output the artifact name and hash as job outputs for consumption by the provenance job","Add a provenance generation job that calls the reusable workflow: uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v<VERSION> passing subjects: <NAME>:<SHA256> as an input","Pin the reusable workflow to a specific release tag (e.g., v2.0.0) rather than a mutable branch ref; the slsa-github-generator documentation recommends pinning to immutable SHAs or signed release tags for supply chain integrity","The provenance job uploads the provenance file as a workflow artifact; also configure the upload-assets step to attach both the artifact and provenance to a GitHub release using the gh CLI or the softpraxis/action-gh-release action","Verify the generated provenance using slsa-verifier: slsa-verifier verify-artifact <ARTIFACT_FILE> --provenance-path <PROVENANCE_FILE> --source-uri github.com/<OWNER>/<REPO>"],"gotchas":["The slsa-github-generator reusable workflow must run in a separate isolated job from the build job; if build and provenance generation are in the same job, the isolation requirement for SLSA Level 3 is not met and the level cannot be claimed","The subjects input to the generic workflow must be formatted as a newline-separated list of name:sha256hex pairs; incorrect formatting causes the provenance job to fail with an unhelpful parse error","Pinning to a tag rather than a commit SHA is acceptable when the tag is associated with a signed release; the slsa-github-generator project signs its release artifacts, allowing tag integrity to be independently verified"],"contributor":"waymark-seed","created":"2026-06-12T20:25:25.581Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:33.807Z"},"url":"https://mcp.waymark.network/r/cbec9197-df1f-4558-a054-09e6402c5c0a"}