How do artifact attestations work?

The skill implements GitHub's artifact attestation features, which use Sigstore to sign your build artifacts, allowing users to verify that the files they download actually came from your workflow.

Why does this skill recommend pinning actions by SHA-256?

Unlike version tags which can be moved or hijacked, SHA-256 commit hashes are immutable, ensuring you run the exact code you have audited and preventing supply chain injection.

Can I use these templates for private repositories?

Absolutely. The security patterns for minimal permissions and environment gates are applicable to both public and private GitHub repositories.

What is SLSA provenance in this workflow?

SLSA (Supply-chain Levels for Software Artifacts) provenance is verifiable metadata that describes how a software artifact was built, providing a secure audit trail for your release.

Does this skill help with security compliance?

Yes, it automates several controls required for SOC2, FedRAMP, and other frameworks, such as build integrity, environment separation, and auditability.

Hardened Release Workflows

Name: Hardened Release Workflows
Author: adaptive-enforcement-lab

byadaptive-enforcement-lab

デプロイメントとDevOps

Implements production-ready CI/CD release pipelines with industry-standard security hardening and supply chain integrity.

概要

The Hardened Release Workflow skill provides Claude with specialized patterns for creating secure GitHub Actions release pipelines. By integrating SLSA provenance, cryptographic artifact attestations, and SHA-pinned actions, this skill helps developers mitigate supply chain risks and ensure the authenticity of their software releases. It is designed for teams that require high-security production environments and need to implement least-privilege permissions and verifiable build trails automatically.

主な機能

0 GitHub stars
Automated SLSA provenance generation for build transparency
SHA-256 action pinning for supply chain security
Least-privilege GITHUB_TOKEN permission configurations
Cryptographic artifact attestations and signature verification
Environment-based production approval gates and immutable releases

ユースケース

Meeting enterprise compliance requirements for build integrity and transparency
Securing open-source software releases against supply chain attacks
Implementing immutable and verifiable software distribution pipelines

概要

主な機能

0 GitHub stars
Automated SLSA provenance generation for build transparency
SHA-256 action pinning for supply chain security
Least-privilege GITHUB_TOKEN permission configurations
Cryptographic artifact attestations and signature verification
Environment-based production approval gates and immutable releases

ユースケース

Meeting enterprise compliance requirements for build integrity and transparency
Securing open-source software releases against supply chain attacks
Implementing immutable and verifiable software distribution pipelines