Generate Generic Attestations

Version updated for https://github.com/actions/attest to version v4.0.0.

  • This publisher is shown as ‘verified’ by GitHub.
  • This action is used across all versions by 186 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The actions/attest GitHub Action automates the creation of signed attestations for workflow artifacts, linking an artifact and its metadata (e.g., build provenance or SBOM) using the in-toto format. It generates verifiable signatures via Sigstore certificates and uploads the attestations to the GitHub Attestations API, enabling secure artifact provenance and traceability. This action supports three attestation modes—Provenance, SBOM, and Custom—to accommodate various use cases and integrates seamlessly into GitHub workflows.

Release notes

All of the capabilities of actions/attest-build-provenance, and actions/attest-sbom have now been folded into actions/attest.

What’s Changed

Full Changelog: https://github.com/actions/attest/compare/v3.2.0...v4.0.0