Generate Slsa Build Provenance In Github Actions

---
name: "Generate SLSA build provenance in GitHub Actions"
slug: "generate-slsa-build-provenance-in-github-actions"
description: "Attach signed SLSA provenance to GitHub Actions builds so release artifacts ship with verifiable supply-chain metadata."
github_stars: 566
verification: "security_reviewed"
source: "https://github.com/slsa-framework/slsa-github-generator"
author: "SLSA maintainers"
publisher_type: "organization"
category: "Security & Verification"
framework: "Multi-Framework"
tool_ecosystem:
  github_repo: "slsa-framework/slsa-github-generator"
  github_stars: 566
---

# Generate SLSA build provenance in GitHub Actions

Attach signed SLSA provenance to GitHub Actions builds so release artifacts ship with verifiable supply-chain metadata.

## Prerequisites

GitHub Actions, SLSA GitHub Generator

## Installation

Requirements and caveats from upstream:
- [![docker-bench-security stars](https://img.shields.io/github/stars/docker/docker-bench-security?logo=github&label=docker/docker-bench-security)](https://github.com/docker/docker-bench-security)
- [![powertools-lambda-python stars](https://img.shields.io/github/stars/aws-powertools/powertools-lambda-python?logo=github&label=aws-powertools/powertools-lambda-python)](https://github.com/aws-powertools/powertools-l...
- | [Node.js](https://nodejs.org) projects | [Node.js Builder](internal/builders/nodejs/README.md) | Builds and generates provenance for npm packages | [Beta since v1.6.0](https://github.com/slsa-framework/slsa-github-g...

Basic usage or getting-started notes:
- [SLSA Build level 3 and above](https://slsa.dev/spec/v1.0/levels). See some
- [popular projects](#hall-of-fame) generating provenance using this project.
- tools for building a SLSA builder on GitHub using the

- Source: https://github.com/slsa-framework/slsa-github-generator
- Extracted from upstream docs: https://raw.githubusercontent.com/slsa-framework/slsa-github-generator/HEAD/README.md

## Documentation

- https://github.com/slsa-framework/slsa-github-generator

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/generate-slsa-build-provenance-in-github-actions/)