Skip to content
cccskills
FreePublished on GitHub

add-artifact-attestations-to-workflow

Add SLSA build-provenance attestations to existing GitHub Actions workflows. Use when the user wants to add artifact attestations, build provenance, or SLSA attestations to Docker container image builds in GitHub Actions CI/CD pipelines.

The English summary is being prepared. Showing the original description.

jim60105/copilot-prompt
Works withGitHubDocker
See how to install

Files included (1)

  • SKILL.md3.8 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Add Artifact Attestations to Workflow

Add SLSA build-provenance attestations to existing GitHub Actions workflows for Docker container images.

Steps

  1. Find existing workflow files in .github/workflows/ that contain docker/build-push-action or similar steps. Note that composite actions may be used — read both the composite action and the calling workflow simultaneously.

  2. Enable OIDC & Attestations permissions In each workflow's top-level permissions: block, grant both the OIDC token and attestations write privileges:

    permissions:
  id-token: write
  attestations: write
  contents: read       # (existing)
  packages: write      # (existing)

  3. Log in to container registries Ensure authentication steps exist for each registry you'll attest against. Judge whether there are omissions based on the implemented content, rather than always logging into all registries.

    - name: Login to GHCR
  uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

- name: Login to Docker Hub
  uses: docker/login-action@v3
  with:
    registry: index.docker.io
    username: ${{ secrets.DOCKERHUB_USERNAME }}
    password: ${{ secrets.DOCKERHUB_TOKEN }}

- name: Login to Quay
  uses: docker/login-action@v3
  with:
    registry: quay.io
    username: ${{ secrets.QUAY_USERNAME }}
    password: ${{ secrets.QUAY_TOKEN }}

  4. Build & push image, capturing the digest Use docker/build-push-action@v* with an id to reference its output. Judge tags based on implemented content.

    - name: Build and push image
  id: build_push
  uses: docker/build-push-action@v5
  with:
    context: .
    push: true
    tags: |
      ghcr.io/${{ github.repository }}:latest
      index.docker.io/${{ secrets.DOCKERHUB_USERNAME }}/your-repo:latest
      quay.io/${{ github.repository_owner }}/your-repo:latest

  5. Add attestation steps After the build_push step, insert one actions/attest-build-provenance@v3 invocation per registry. The subject-name is the full image name without a tag. The subject-digest comes from the build step's output. Judge which registries to use based on implemented content.

    - name: Attest GHCR image
  uses: actions/attest-build-provenance@v3
  with:
    subject-name: ghcr.io/${{ github.repository }}
    subject-digest: ${{ steps.build_push.outputs.digest }}

- name: Attest Docker Hub image
  uses: actions/attest-build-provenance@v3
  with:
    subject-name: index.docker.io/${{ secrets.DOCKERHUB_USERNAME }}/your-repo
    subject-digest: ${{ steps.build_push.outputs.digest }}

- name: Attest Quay image
  uses: actions/attest-build-provenance@v3
  with:
    subject-name: quay.io/${{ github.repository_owner }}/your-repo
    subject-digest: ${{ steps.build_push.outputs.digest }}

  6. Commit changes Write the git commit message in English.

    git add .github/workflows/docker_publish.yml # or whatever files you modified
git commit --signoff -m "ci: add build-provenance attestations for container images"

  7. Ask the user to push Tell the user to manually push the changes and verify attestations are created successfully. DO NOT perform a git push.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

agent-browser

Free

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction.

The English summary is being prepared. Showing the original description.

jim60105/copilot-prompt22Updated Oct 16, 2026

api-security

Free

Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.

The English summary is being prepared. Showing the original description.

jim60105/copilot-prompt22Updated Oct 16, 2026

bash-script-writer

Free

Write, review, and optionally test Bash and Zsh shell scripts following project coding standards. Use for ANY shell scripting task: (1) creating a new Bash or Zsh script, (2) editing, fixing, or reviewing an existing .sh, .bash, or .zsh file, (3) adding error handling, dependency checks, or cleanup traps to shell scripts, (4) implementing API integration or file processing in shell, (5) writing or fixing ShellSpec tests (spec/*_spec.sh), or (6) deciding whether a script should be written in Bash or Zsh. Defaults to Bash; Zsh-specific guidance lives in a reference file that is loaded only when writing Zsh.

The English summary is being prepared. Showing the original description.

jim60105/copilot-prompt22Updated Oct 16, 2026

brainstorming

Free

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

The English summary is being prepared. Showing the original description.

jim60105/copilot-prompt22Updated Oct 16, 2026

bruno-api-testing

Free

Create, run, and maintain API test collections using Bruno (OpenCollection YAML format and legacy Bru format). Use when the user wants to: (1) create a Bruno API test collection from scratch or from OpenAPI/Swagger specs, (2) write API request files with tests and assertions, (3) run API tests using bru CLI, (4) generate test reports (HTML, JUnit, JSON), (5) set up CI/CD pipelines (GitHub Actions) for automated API testing, (6) debug or fix failing Bruno API tests, (7) add environment configurations for API testing, (8) chain API requests with data extraction, or (9) work with any .yml/.bru Bruno collection files. Triggers on mentions of 'Bruno', 'bru CLI', 'API testing collection', 'OpenCollection', or requests to automate API testing with file-based collections.

The English summary is being prepared. Showing the original description.

jim60105/copilot-prompt22Updated Oct 16, 2026

bump-version

Free

Automate version bumping following semantic versioning and changelog management. Use when the user wants to bump a version, create a release, update the changelog, or tag a new version in a project using semver conventions and Keep a Changelog format.

The English summary is being prepared. Showing the original description.

jim60105/copilot-prompt22Updated Oct 16, 2026

See all skills by jim60105

Report a problem with this skill