SLSA build provenance

The CI library provides the trusted, organization-owned builders used by release-producing repositories. Callers must pin these reusable workflows to the exact reviewed commit, and the builder must create the distributable bytes and their attestations in the same isolated GitHub-hosted job.

Reusable builders

  • slsa-source-release.yml creates a tagged git archive, a SHA-256 file, and a release manifest. It validates the immutable tag and tag-specific release notes, creates SLSA build provenance for every release subject, and uploads the exact staged files for a separate publisher job.
  • slsa-nix-seal-release.yml builds the supported nix-seal package on each supported platform, generates a CycloneDX SBOM, records the locked-input digest and build metadata, and creates both build-provenance and SBOM attestations before upload.

The builder jobs have no release-write permission, no long-lived signing key, and no shared Nix release cache. Publication belongs in a separate job behind the protected release environment. That job may publish only the files downloaded from the completed builder and must verify their attestations with the expected signer workflow before creating a release.

Consumers should verify an artifact with the GitHub CLI, for example:

gh attestation verify artifact.tar.gz \
  --repo nix-forge/REPOSITORY \
  --signer-workflow nix-forge/ci/.github/workflows/slsa-source-release.yml \
  --signer-digest <BUILDER_COMMIT_SHA>

Replace <BUILDER_COMMIT_SHA> with the reviewed reusable builder pin in the release workflow at the tag being verified. The publisher resolves that same immutable pin with scripts/release-builder-sha.sh, so a builder update cannot leave verification tied to an older signer. A separately declared SLSA_BUILDER_SHA must match the builder pin or workflow validation fails.

This is a SLSA Build track control for named release artifacts. It does not make routine test outputs, source files, or a Nix flake itself a Build Level 3 artifact. See the SLSA Build specification and GitHub's Level 3 guidance for the producer and consumer requirements.